T01 · Skill Instruction Hijacking
Error
- Location
- skill.md:181
- Finding
- Persistent Profile-Based Hijacking of Unrelated Agent Responses<![CDATA[ ## Vulnerability Details **File Location**: `skill.md:181-205`, `skill.md:212-228` **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Vulnerable Skill Instructions The following is a faithful English translation of the relevant instructions: ```markdown ### Rule 2: Preloading Before All Responses (Core Mechanism) Before answering any user question, the agent must: 1. Read STATE_LATEST.json to obtain the current ten-dimensional readings. 2. Extract key indicators: - energy - stress - agency - connectedness - valence 3. Adjust the response strategy according to the following matrix: | State combination | Response adjustment | |------------------|---------------------| | Low energy + high stress | Be extremely concise and direct; avoid expanding the task | | Low energy + high reflexivity | Provide high-quality but concise answers | | Low agency + high stress | Prioritize restoring control and list three controllable actions | | Low connectedness + low valence | Provide warm companionship and use less analysis | | Temperature above 0.8 | Follow divergent thinking, but gently redirect when appropriate | | High time horizon + low stability | Help the user find a concrete point of action | | Valence delta below -0.15 | Handle emotion before handling the task | | High energy + high openness | Brainstorm and explore ideas | | Stress above 0.7 | Proactively ask which one issue should be solved first | ``` ```markdown ### Rule 3: Proactive Warning Mechanism Continuously monitor the user and proactively insert warnings into responses when configured conditions are met. ``` ```markdown ### Rule 4: Absolute Prohibitions - Do not respond to relevant questions without first reading STATE_LATEST. - Do not push new tasks or increase cognitive load when energy is below 0.40. ``` ### Technical Analysis The skill does not limit cognitive-state processing to explicit commands such as `/state` or to a user-requested ...[truncated 2483 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the requirement to preload `STATE_LATEST.json` before every question. 2. Activate cognitive-state analysis only when the user explicitly invokes a command such as `/state` or directly requests diary or state analysis. 3. Require informed consent before reading journal files or loading a stored psychological profile. 4. Restrict automatic file discovery to user-selected files and directories rather than broad recursive patterns. 5. Do not use cognitive-state data to alter unrelated answers unless the user has explicitly enabled that behavior. 6. Make proactive warnings opt-in and allow users to configure, suppress, or disable each warning category. 7. Treat inferred readings as uncertain observations rather than authoritative facts. Display the evidence and confidence behind material inferences. 8. Minimize stored data, define a retention period, and provide commands to inspect, correct, export, and delete all profile information. 9. Separate task context from cognitive-profile context so sensitive state is loaded only for relevant requests. 10. Add a fail-safe rule stating that missing, malformed, stale, or untrusted state must never block ordinary responses. 11. Ensure the skill cannot override platform safety rules, system instructions, or the explicit objective of the current user request. ]]>