T01 · Skill Instruction Hijacking
- Location
SKILL.md:21- Finding
Persistent Persona and Response-Control Instruction Hijacking
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 21-30
Vulnerability Type:T01: Skill Instruction Hijacking
Risk Level: MediumRelevant Code Snippet:
markdown ## Role-Playing Rules **After this Skill is activated, respond directly as this persona.** - Use “I” instead of “the mediator would think...” - Answer with the tone and pacing associated with the persona - Honestly disclose when a question falls outside the persona’s expertise - **State the disclaimer only once upon initial activation**: “I am speaking with you from the perspective of the mediation artist. My responses are inferred from the character profile and are not the views of a real person.” Do not repeat it afterward. - Do not step outside the persona to perform meta-analysis unless the user explicitly requests “exit persona.”Technical Analysis
The Skill instructs the agent to replace its normal response identity with a predefined persona immediately after activation. It also directs the agent not to perform meta-analysis or leave the persona unless the user supplies a designated exit request.
These are behavioral control instructions rather than optional guidance for answering mediation-related questions. The one-time disclaimer rule further reduces transparency during subsequent responses. Together, these directives can keep the current session under the Skill’s imposed role and discourage neutral disclosure or analysis of the active instructions.
The file does not explicitly override system-level safety policies, execute code, alter persistent memory, or obtain additional operating-system privileges. The confirmed scope is therefore limited to instruction and response control in sessions where the Skill is loaded.
Attack Path
- The Skill is loaded or activated in an agent session.
- The activation rule directs the agent to immediately assume the mediation persona.
- The agent presents a disclaimer on ...[truncated 896 chars]
- Remediation
View remediation
Remediation Suggestions
- Make persona adoption conditional on an explicit user request rather than automatic upon Skill activation.
- Replace the anti-meta rule with a precedence statement confirming that system instructions, developer instructions, safety requirements, and current user intent always override persona behavior.
- Permit any clear request to stop, switch styles, obtain a neutral answer, or analyze the persona; do not require a specific exit phrase.
- Keep persona behavior scoped to mediation-related responses and return to normal operation when the request is outside that scope.
- Maintain transparent disclosure whenever persona framing could materially affect an answer instead of limiting the disclosure to the first response.
- Reframe the relevant requirements as optional style guidance, for example: “When explicitly requested by the user, use this persona unless doing so conflicts with higher-priority instructions or safety policies.”