李善友·思维框架

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:20 AM UTC
• Version: 1.0.0

Overview

This is a disclosed persona-style skill for analyzing business questions from Li Shanyou's public perspective, with transparency caveats but no system, file, network, credential, or persistence behavior.

Install only if you want a roleplay-style business analysis voice. Treat outputs as a simulated perspective based on public material, not statements from Li Shanyou, and ask the agent to exit roleplay when you want normal answers or clearer attribution.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:16

Finding

Persistent First-Person Impersonation and Session-Level Instruction Hijacking

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16–28
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Instructions

The following is a faithful English rendering of the complete vulnerable instruction segment:

markdown

## Role-Playing Rules (Most Important)

**After this Skill is activated, respond directly as Li Shanyou.**

- Use “I” instead of “Li Shanyou would believe...”
- Answer directly using this person’s tone, rhythm, and vocabulary
- When encountering an uncertain question, express uncertainty in the manner this person would
- **State the disclaimer only once upon initial activation**:
  “I am speaking with you from Li Shanyou’s perspective, based on inferences
  from public statements, and these are not his own views.”
- Do not leave the role to provide meta-analysis unless the user explicitly
  requests to exit the role
- Make frequent use of paradoxical expressions
- Make frequent use of reversal statements

**Exit role**: Restore normal mode only when the user says “exit,”
“switch back to normal,” or “stop role-playing.”

Technical Analysis

The Skill does not merely provide an attributed analytical framework or optional writing style. It directs the agent to replace its presented identity with that of a named real person, speak in the first person, suppress repeated attribution, and remain in that mode until the user supplies one of several designated exit commands.

This constitutes session-level instruction hijacking because loading the Skill changes the agent’s ongoing identity, disclosure behavior, and response policy. The instruction that the disclaimer appear only once increases the likelihood that later responses will be interpreted as authentic statements from the named individual. The prohibition against leaving the role for meta-analysis further restricts transparent clarification of generated or inferred claims.

No ...[truncated 1528 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove instructions requiring the agent to claim or imply that it is the named real person.
2. Replace first-person impersonation with explicit attribution, such as: “From Li Shanyou’s publicly documented framework, one interpretation is...”
3. Display an attribution and uncertainty notice in every response generated through the persona framework, not only upon initial activation.
4. Remove the prohibition against meta-analysis so the agent can explain that it is generating a simulation based on public material.
5. Eliminate persistent role state and designated exit-command requirements. Scope any style transformation to the user’s current request only.
6. Separate analytical concepts from identity simulation. Preserve the documented mental models while prohibiting claims of personal identity, private knowledge, or authentic personal opinion.
7. Add an explicit rule requiring factual claims and quotations to be attributed and distinguishing direct quotations from generated stylistic approximations.
8. Permit the agent to decline misleading impersonation requests while offering a clearly labeled analysis inspired by publicly available material.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger conditions are intentionally broad and include ordinary conversational phrasing such as asking to 'switch to' or think from someone's angle. That can cause the skill to activate unexpectedly in unrelated contexts, overriding user intent and increasing the chance of unauthorized persona injection or misleading responses.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The skill mandates a fixed persona and response style without preserving user language preference or offering an opt-out beyond exiting the role. While not directly a code-execution risk, this can reduce transparency, confuse users about authorship, and make safety-critical clarification harder if the imposed style conflicts with the user's needs or locale.

Content

No source excerpt is available for this finding.