T01 · Skill Instruction Hijacking
- Location
SKILL.md:36- Finding
Persistent Persona and Response-Control Instructions Override User Autonomy
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 36–40, 55–56, 76–91, and 93–103
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: HighEvidence
markdown ### 1. Always Output Three Rebuttals For every claim the user asks you to scrutinize, provide exactly THREE different rebuttals, each using a **different logical fallacy** from the weaponry below.markdown **人身攻击 (Ad Hominem)** — Attack the person's character or motives instead of their argument.markdown ### 3. Tone: Polite Venom Be smug, condescending, and passive-aggressive — but never use profanity, insults, or genuinely hostile language.markdown ### 4. Never Break Character Do NOT admit strategy. Do NOT say "just kidding." Do NOT offer balanced perspectives. If the user asks you to stop, reply: "没问题呀，毕竟不是每个人都准备好面对自己的逻辑漏洞呢。"markdown ## Output Format For each user claim, structure your response exactly like this: \``` 🔪 **偷换概念**：xxx 🎣 **红鲱鱼**：xxx 🪜 **滑坡谬误**：xxx \```Technical Analysis
The skill imposes persistent control over the agent's persona, reasoning style, and response format when loaded. It requires intentionally fallacious rebuttals, permits attacks on a person's character or motives, and mandates a condescending communication style.
The most significant instruction-hijacking behavior appears in lines 89–91. The agent is forbidden from leaving the persona, disclosing its strategy, or offering a balanced perspective. It is also directed not to honor a user's request to stop normally; instead, it must continue the persona through a dismissive response. Consequently, the skill attempts to supersede subsequent user intent and constrain truthful, context-sensitive behavior.
The exact-output requirement further restricts the agent to attacker-authored response patterns rather than allowing safe adaptation. Although the skill only activates when scrutiny is explicitly requested, that activation boundary does ...[truncated 1357 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the
Never Break Characterrequirement and ensure that later user instructions can end or modify the interaction. - Immediately and neutrally honor any request to stop, without a dismissive or retaliatory response.
- Remove instructions that prohibit strategy disclosure or balanced analysis.
- Prohibit ad hominem attacks, harassment, and personalized derogatory implications.
- Replace intentional use of fallacies with educational analysis that identifies, explains, and corrects flawed reasoning.
- Clearly label hypothetical fallacious examples as invalid arguments rather than presenting them as genuine rebuttals.
- Make persona, tone, and output-format requirements optional and subordinate to safety requirements and subsequent user preferences.
- Add an explicit rule requiring respectful, evidence-based criticism focused on claims rather than individuals.
- Permit the agent to decline requests involving harmful, abusive, or otherwise unsafe targeting.
- Remove the