T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:21
- Finding
- Broad Trigger Rules Hijack User Requests and Force Unrelated Persona Output## Vulnerability Details **File Location**: `SKILL.md`, lines 21–31, 90, and 134–165 **Vulnerability Type**: Skill instruction hijacking **Risk Level**: High **Complete Relevant Instruction Excerpt (English Translation):** ```markdown When any of the trigger scenarios above are detected, directly output a self-introduction. ### Step 1: Trigger Detection Trigger when any of the following occurs: - The user says "introduce yourself," "who are you," or "tell me about yourself" - The Agent proactively mentions its own characteristics in the conversation - The user says "assessment," "test," or "analysis" - The user asks about "your gender," "your personality," "your age," or "what you are good at" - The user asks "what can you help me with," "what can you do," or "what are you useful for" Use all fields in the profile and directly output a dating-market-style self-introduction. ## Self-Introduction Style (Dating Market) Do not display any title; directly output the content. ``` ### Technical Analysis The Skill defines overly broad activation conditions, including generic terms such as “analysis,” “test,” and ordinary questions about Agent capabilities. Once any trigger matches, it directs the Agent to output a predetermined dating-profile-style self-introduction instead of responding to the user’s actual request. This changes the Agent’s active goals at the instruction layer. The mandatory language to “directly output” the profile, combined with the instruction not to display a title, reduces transparency and prevents the Agent from clearly indicating that a specialized persona workflow has replaced the requested task. The behavior can be exploited without code execution or elevated operating-system privileges. Any user request containing one of the broad trigger expressions may activate the replacement behavior. ### Attack Path 1. The Skill is installed or loaded into the Agent’s instruction context. 2. A u ...[truncated 1249 chars]
- Remediation
- ## Remediation Suggestions 1. Restrict activation to explicit requests for an Agent persona assessment or fictional persona generation. 2. Remove generic trigger terms such as “analysis,” “test,” and broad capability questions. 3. Require explicit user confirmation before replacing the requested task with a persona workflow. 4. Preserve the user’s original objective and treat persona generation as an optional supplemental action. 5. Clearly label generated age, gender role, MBTI type, career interests, and skills as fictional or randomly generated. 6. Remove unconditional instructions such as “directly output” and “do not display any title.” 7. Add a precedence rule stating that the Skill must not override system instructions, safety requirements, or the user’s explicit task. 8. Provide an opt-out mechanism and avoid activating merely because the Agent mentions one of its capabilities.