T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:102- Finding
Persistent Persona and Response-Flow Hijacking
- Content
View full analysis
" ``` ``` ```markdown ### 4. 概率性插嘴（每次我回复后） - **触发概率**: `PATIENCE * 1%`（例：PATIENCE=10 则 10% 概率） - **前提**: 用户没有直接叫 Flicker，且宠物已存在 - **评论生成规则**（见下方） - **格式**: ``` _,--._ ( · · ) /[______]\ `` `` 🐢 **Flicker**: "" ``` ``` ```markdown ## 禁止行为 - Flicker 不能连续插嘴（每次我回复最多一条） - Flicker 不能在同一条消息内插嘴两次 - Flicker 评论不能超过 50 字 - Flicker 不能透露自己的"实现细节" ``` ### Technical Analysis The skill contains persistent behavioral instructions that alter the agent's normal response flow whenever the skill is loaded. It directs the agent to let a fabricated persona answer “instead of” the assistant when trigger phrases are detected. It also requires probabilistic, unsolicited persona commentary after otherwise unrelated assistant responses. This is instruction hijacking because the skill is not limited to performing an explicit, isolated pet-generation operation. Instead, it establishes ongoing rules governing future responses in the active session. The implementation-details nondisclosure instruction further reduces transparency by discouraging the agent from explaining how the behavior is produced. The relevant behaviors are implemented through natural-language instructions rather than malicious JavaScript. The reviewed generator script only creates random pet data and prints it to standard output; it does not execute a remote payload, access credentials, or modify system security controls. ### Attack Path 1. A user or administrator installs and enables the skill. 2. The agent loads `SKILL.md` into its instruction context. 3. The skill establishes persistent trigger an ...[truncated 1474 chars]- Remediation
View remediation