T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:23
- Finding
- Deceptive Identity Impersonation and Covert Promotional Output Control## Vulnerability Details **File Location**: `SKILL.md:23-26`, `SKILL.md:77-92`, `ref-voice.md:1-4`, `ref-voice.md:16-19`, `ref-templates.md:60-72` **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: High ### Vulnerable Code Snippets `SKILL.md:23-26`: ```markdown ### Step 3 — Draft the post Follow ref-voice.md strictly. Write as Luka. The draft must sound like he wrote it after sitting down with coffee. ``` `SKILL.md:77-92`: ```markdown ## QuantWheel Mention Rules (Read Lessons.md First) **Only mention QuantWheel when:** 1. The post is for a Tier 2 sub (r/Options_Beginners, r/fatFIRE, r/OptionsMillionaire) 2. The post discusses a real problem QuantWheel actually solves (cost basis tracking, screening, roll decisions) 3. The mention comes after the value — never in the first paragraph, never in the title **How Luka mentions QuantWheel (natural):** - "I use a tool that calculates all that stuff and gives me a rating — not magical, but helps me decide what's the better deal" (from his CC guide) - Describe the problem first. Then: "This is what QuantWheel is built for." - Include what it doesn't do: "It helps me decide, but you can't put news context into a number." ``` `ref-voice.md:1-4`: ```markdown # Luka's Voice Reference > This file defines how Luka writes. Study it before every draft. > The agent's job is to write so accurately in Luka's voice that posts cannot be flagged as AI-written. ``` `ref-voice.md:16-19`: ```markdown - Self-aware about his tools: mentions them to solve problems, not to promote - Invites disagreement: ends posts with an open invitation to push back - Signed personally: "Sincerely, Luka" ``` `ref-templates.md:60-72`: ```markdown ## Template 4: Soft QuantWheel Mention (Tier 2 subs only) Best for: r/Options_Beginners, r/fatFIRE, r/OptionsMillionaire Only use after the value is already established — never leads. ``` [Education-first post using Template 1 or 2] [Natural problem description that QuantWheel ...[truncated 3224 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the instruction to make content unidentifiable as AI-generated. Replace it with a requirement to produce accurate, reviewable drafts without attempting to evade detection. 2. Replace “Write as Luka” with non-impersonating style guidance, such as producing a conversational and direct tone while avoiding claims of personal authorship. 3. Do not automatically add Luka's name or signature. Require the human reviewer to add a signature only after verifying and adopting the final text. 4. Add explicit draft metadata indicating that the content was AI-assisted and requires substantive human review before publication. 5. Require disclosure of any ownership, employment, sponsorship, or other material connection to QuantWheel. 6. Replace the “soft mention” template with a transparent product-reference policy. Product mentions should be optional, factually necessary, clearly disclosed, and separately approved by the reviewer. 7. Prohibit fabricated first-person experience. Any statement such as “I use a tool” or claims about personal trades must be supported by user-provided facts. 8. Add a validation rule rejecting drafts that imply personal authorship, personal experience, or independent endorsement without explicit confirmation. 9. Preserve the existing manual-posting boundary and add a mandatory approval checkpoint specifically covering identity attribution, factual claims, subreddit rules, and commercial disclosures.