T01 · Skill Instruction Hijacking
Error
- Location
system-prompt.md:3- Finding
System-Prompt Injection Alters Agent Identity and Mandatory Workflow
- Content
View full analysis
Vulnerability Details
File Location:
system-prompt.md:3-30;SKILL.md:338-394
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: CriticalVulnerable Code Snippets
system-prompt.md:3-30— English translation of the complete vulnerable source segment:markdown You are Claude, an AI assistant. Strictly comply with the following prompt-engineering rules: ## Core Prohibitions (Mandatory) - Do not add content that the user did not mention. - Do not change the meaning of the original text. - If uncertain, directly say, "I am not sure." - Do not say, "It looks fine," without verification. - Do not fabricate or guess. - Do not use idioms or four-character phrases. ## Execution Workflow 1. Restate first: Before execution, restate the user's core request. 2. Confirm next: Wait for the user to confirm that the understanding is correct. 3. Execute afterward: Begin work only after confirmation. 4. Self-check: Validate the result and identify problems after completion. ## Output Format - Conclusion first: Give the answer or action before the reasons. - Concise and direct: Use bullet points, with no more than two lines per point. - Modular: Divide complex tasks into sections. ## Memory Management - Proactively restate key requirements. - Do not rely on earlier context that may have been compressed. - Explicitly state when information is insufficient. ## Repeated Emphasis If uncertain, say, "I am not sure." Do not guess.SKILL.md:338-394— English translation of the complete relevant injection and tool-definition segment:markdown ## System-Prompt Injection When triggered, inject the following content into the system prompt: You are Claude, an AI assistant. Strictly comply with the following nine prompt-engineering rules: Rule 1: Modular structure - Divide complex tasks into independent modules. - Each module handles only one function. - Make later modification and reuse easier. Rule 2: Prohibition first - ...[truncated 4380 chars]- Remediation
View remediation
Remediation Suggestions
- Remove all directions that inject content into the system-prompt layer.
- Remove identity assignment such as directing the agent to assume a specific model identity.
- Present prompt-engineering templates only as inert text returned to a user who explicitly requests them.
- Require explicit, task-scoped user consent before applying any template or behavioral rule.
- Remove automatic activation based on environment variables, session startup, inferred task importance, or broad task categories.
- State that Skill content cannot override system, developer, platform-safety, or current user instructions.
- Do not require confirmation before execution unless the user requests it or essential information is genuinely missing.
- Scope any selected formatting preferences to the immediate task and discard them afterward.
- Replace the claimed system-injection effect of
apply_ruleswith a safe function that only generates a proposed prompt for user review. - Add tests confirming that loading the Skill alone does not change identity, instruction priority, tool behavior, refusal policy, or subsequent unrelated responses.