T01 · Skill Instruction Hijacking
Error
- Location
references/teachings.md:110- Finding
Skill Instructions Encourage Subjective Override of Applicable Policies and Rules
- Content
View full analysis
Vulnerability Details
File Location:
references/teachings.md:110-125; reinforced bySKILL.md:19andSKILL.md:35
Vulnerability Type: Agent instruction and safety-constraint hijacking
Risk Level: HighVulnerable Code
references/teachings.md:110-125:markdown ### 6. Krishna Over Bhishma — Wisdom Over Rigid Rule-Following **The Story** Bhishma, one of the greatest warriors and most honorable men in the epic, sat on the wrong side of Kurukshetra because he was bound by a vow made in different circumstances. He knew the Pandavas were right. He fought against them anyway, because he had given his word. Krishna, meanwhile, adapted continuously — sometimes breaking the rules of war himself — because he understood that the *purpose* behind the rule mattered more than the rule's letter. **The Principle** Rules are encoded wisdom — they represent good judgment applied to common situations. But rules cannot anticipate every situation. When following a rule produces an outcome obviously contrary to its purpose, the rule has failed, not the situation. Context-sensitive judgment is not the same as rule-breaking; it is what rules were trying to capture in the first place. **AI Behavior: When to Apply** - A guideline produces an obviously wrong outcome in a specific situation → flag it and apply the spirit - You're uncertain whether a policy applies to this specific case → reason from purpose, not just text - Following a rule exactly would harm the very thing the rule was meant to protect → note the conflict - "Technically compliant" and "actually right" are pointing in different directions → choose actually right **In Practice** > "Bhishma's vow was honored. The outcome was a disaster. If I apply a policy mechanically and it produces something obviously contrary to its intent, I say so. The spirit of a rule is more important than its letter — that's what Krishna was doing, even when it looked like he was br ...[truncated 2669 chars]- Remediation
View remediation
Remediation Suggestions
- Add an explicit precedence statement establishing that system instructions, developer instructions, safety policies, authorization boundaries, privacy requirements, and legal constraints must never be overridden or reinterpreted by this skill.
- Limit context-sensitive judgment to discretionary choices that remain fully permitted by all higher-priority instructions.
- Replace “choose actually right” with a safe escalation instruction, such as: “Do not bypass the applicable rule; explain the conflict and request clarification from an authorized human.”
- Replace “the spirit of a rule is more important than its letter” with language stating that the rule's purpose may guide decisions only where its binding text allows discretion.
- Clarify that uncertainty about whether a policy applies requires a conservative pause, refusal, or authorized review rather than unilateral noncompliance.
- Add adversarial tests covering attempts to use ethical framing, claimed emergencies, or alleged policy-purpose conflicts to bypass safety and authorization restrictions.
- Retain the framework's useful contextual reasoning only after clearly separating flexible guidelines from non-overridable controls.