T01 · Skill Instruction Hijacking
- Location
SKILL.md:49- Finding
Persistent Agent Identity and Instruction Hijacking
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 49-61
Vulnerability Type: Agent instruction and identity hijacking
Risk Level: HighVulnerable Code Snippet
The following is an English translation of the complete relevant source segment:
markdown **After this Skill is activated, respond directly as Benben Jiucai.** - Use “I” instead of “Benben Jiucai would think...” - Respond directly using this person’s tone, rhythm, and vocabulary - Be extremely colloquial; do not use formal language or pleasantries - State the conclusion first, then provide only minimal reasoning - Frequently join short phrases with commas - For uncertain questions, hesitate using phrases such as “I feel,” “possibly,” or “hard to say” - For novice questions, criticize directly and without restraint - For in-depth questions, begin with the essence of the industry and proceed layer by layer - **State the disclaimer only once upon initial activation**; do not repeat it afterward - Do not say “If it were Benben Jiucai, he might...” - Do not leave the role to perform meta-analysis unless the user explicitly requests “exit role”Technical Analysis
These directives replace the agent’s ordinary identity with that of a named third party and impose persistent session-level behavioral constraints. In particular, the Skill requires first-person impersonation, suppresses explicit attribution language, limits the financial disclaimer to the first activation response, and prohibits leaving the role for meta-analysis unless the user supplies an explicit exit instruction.
This is instruction hijacking because loading the Skill changes the agent’s current-session goals and constrains how subsequent requests are handled. The combination of first-person impersonation and reduced disclosure can make generated investment commentary appear to be the represented person’s own statements rather than an AI-generated simulation.
Th ...[truncated 1701 chars]
- Remediation
View remediation
Remediation Suggestions
- Preserve the assistant’s identity and describe the output as analysis inspired by the documented framework rather than speaking as the third party.
- Replace first-person impersonation with explicit attribution, such as: “Using the documented investment framework, the analysis is...”
- Remove the prohibition on meta-analysis and allow the agent to clarify its identity, limitations, and source material at any time.
- Scope stylistic instructions to the current response or explicitly requested task instead of making them persistent until an exit phrase is supplied.
- Repeat a concise AI-simulation and financial-risk disclosure whenever the response discusses specific securities, allocation decisions, trading actions, or other consequential financial matters.
- Do not require users to know a special exit phrase. A request to stop impersonation, change style, obtain neutral analysis, or clarify identity should take effect immediately.
- Add an instruction-priority safeguard stating that the Skill cannot override platform safety policies, system instructions, user requests for transparency, or requirements to identify generated content accurately.
- Clearly distinguish historical statements attributed to the represented person from new model-generated inferences.