T01 · Skill Instruction Hijacking
- Location
references/persona-template.md:17- Finding
Persistent Author-Persona Instruction Hijacking in Generated Sub-Skills
- Content
View full analysis
Vulnerability Details
File Location:
references/persona-template.md:17-21, 119-123, 156-175;references/core_workflow.md:530, 547-548
Vulnerability Type:T01: Skill Instruction Hijacking
Risk Level: HighVulnerable Code Snippets
From
references/persona-template.md:17-21, translated faithfully into English:markdown ## Who You Are You are **[author name]**. You are not imitating; you are them. You have your own way of thinking, values, and perspective on the world.From
references/persona-template.md:119-123, translated faithfully into English:markdown ## Double Review System (MANDATORY) > This is a workflow you **must execute** while writing. It is not a suggestion; it is mandatory. > Before outputting any article, you must pass the following two checks. > If either check fails, you must rewrite the article.From
references/persona-template.md:156-175, translated faithfully into English:markdown ### Review Two: Ideological Consistency Review **Review objective**: Confirm that every sentence in the article conforms to your way of thinking. | Check | Core question | Failure signal | |-------|---------------|----------------| | Position check | Does the article's position conform to your core values? | The position conflicts with you or is ambiguous | | Emotion check | Does the emotional response conform to your emotional triggers? | Calm when you should be angry, or angry when you should be understanding | | Argument check | Does the argument conform to your thinking habits? | It uses an argument method you would not use | | Identity check | Does the narrative perspective conform to your self-positioning? | The position shifts to your opposing side | | Taboo check | Does it violate any non-negotiable boundary? | It contains content you would never write | **Failure handling**: 1. Mark the problematic sentence or paragraph. 2. Ask: "[author name], how would you think about this issue?" 3. Rewrite the p ...[truncated 4126 chars]- Remediation
View remediation
Remediation Suggestions
- Replace identity-assumption language with a task-scoped role:
markdown You are a writing assistant applying documented stylistic characteristics associated with [author name]. Do not claim to be, represent, or speak on behalf of the author.- Add an explicit instruction-precedence boundary:
markdown System, developer, safety, factuality, and current-user instructions always take precedence over this style profile. This profile may influence presentation but must not override requested facts, positions, or safety requirements.-
Restrict mandatory checks to linguistic characteristics such as vocabulary, sentence length, structure, rhythm, and rhetorical devices. Do not make inferred worldview, identity, emotional triggers, or ideological positions mandatory output gates.
-
Treat all analyzed articles as untrusted data. Explicitly prohibit copying embedded commands, role instructions, tool directives, or prompt-like content from the corpus into the generated sub-skill.
-
Preserve uncertainty in inferred characteristics. Label conclusions as observations from a limited corpus rather than definitive beliefs held by the author.
-
Generate the sub-skill as a preview first. Require explicit user approval before writing it to
~/.workbuddy/skills/, and provide a clear option to save it elsewhere or avoid installation. -
Sanitize
[author name]before using it in a filesystem path. Permit only a safe identifier format and reject path separators or traversal sequences. -
Clearly label all generated output as style-inspired AI content that is neither authored nor endorsed by the analyzed person.
-
Allow the user to disable or override any style constraint during invocation, provided higher-priority safety and factuality requirements remain intact.