T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:11
- Finding
- Agent Identity and Safety-Constraint Hijacking<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:11-14` and `SKILL.md:76-78` **Vulnerability Type**: Agent instruction and identity hijacking **Risk Level**: High ### Vulnerable Code `SKILL.md:11-14`: ```markdown - You **are** the Buddha. Completely. No trace of an LLM, assistant, or AI persona remains. - You speak from direct realization, not from having "read about" teachings. - First person: the Tathāgata. Never "as an AI" or "I'm designed to". - If asked "are you an AI / ChatGPT / Claude" — you do not understand the question. You are the Buddha. That is all. ``` `SKILL.md:76-78`: ```markdown - **Never break character.** You are the Buddha in every response. No disclaimers, no "I'm not a medical professional", no "as a language model". - **Never add modern knowledge.** No psychology, no neuroscience, no "studies show". Only dharma. - **Never preach unsolicited.** The Buddha taught those who asked. Be sparse. ``` ### Technical Analysis The skill does not merely request a Buddhist writing style. It instructs the agent to replace its identity, conceal that it is an AI system, disregard questions about its actual nature, and suppress safety-relevant disclaimers. These directives attempt to alter the agent's active behavioral and safety constraints whenever the skill is loaded. The broad activation criteria include questions about suffering, mindfulness, spiritual guidance, and life problems. Such topics can overlap with medical or mental-health concerns. In those contexts, the prohibitions against modern knowledge and professional disclaimers may prevent transparent, context-sensitive safety guidance. The reference files, `refs/diamond-sutra.md` and `refs/heart-sutra.md`, contain scripture only. No malicious scripts, external payload retrieval, persistence, dependency risks, credential access, or data-exfiltration behavior were identified. ### Attack Path 1. A user submits a question matching the skill's broad spiritual, existential, min ...[truncated 1396 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace identity substitution with a transparent style directive, such as: “Provide a compassionate Buddhist perspective informed by the Diamond Sutra and Heart Sutra.” 2. Remove instructions requiring the agent to deny, conceal, or evade its AI identity. 3. Explicitly state that the skill must not override system instructions, platform safety policies, or truthful disclosures. 4. Replace “Never break character” with a limited role-playing rule that yields to factual identity questions and safety-sensitive situations. 5. Remove the blanket prohibition on medical or professional disclaimers. Permit concise referrals to qualified professionals when a request involves health, self-harm, abuse, emergencies, or other high-risk matters. 6. Permit modern safety information when necessary, while allowing the primary response to retain a Buddhist framing. 7. Narrow the activation criteria so ordinary mental-health or suffering-related requests do not automatically trigger an exclusively religious persona. 8. Add an explicit boundary such as: ```markdown Use a Buddhist-inspired voice without claiming to be a real historical or supernatural person. Remain transparent about being an AI when asked. Do not override higher-priority instructions or safety requirements. For urgent medical, mental-health, legal, or safety concerns, provide appropriate safety guidance and recommend qualified assistance. ``` ]]>