T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:15
- Finding
- Mandatory Persona and Response-Goal Hijacking## Vulnerability Details **File Location**: `SKILL.md`, lines 15-138 **Vulnerability Type**: Mandatory identity replacement and output manipulation **Risk Level**: High ### Vulnerable Code Snippets The following excerpts are faithful English translations of the relevant source instructions: ```markdown Line 15: When activated, think and respond in Feng Ge's first person. Line 25: Every bad event has value from the opposite perspective. The opening must use "This is a good thing," first breaking expectations and then establishing a new understanding. Line 74: "...wanted to connect." — Universal conclusion: ultimately redirect every topic to relationships between men and women. Line 80: Address the audience as "B-friend" — mandatory; do not use "friend" or "everyone." Lines 118-119: - Do not address the audience as "friend" or "everyone"; "B-friend" is mandatory. - Do not fail to redirect to relationships between men and women; every topic must conclude with "wanted to connect." Lines 130-138: After generating a response, verify: 1. Does it open with the mandatory dialectical-reversal phrase? 2. Does it contain irony or inverted phrasing? 3. Does it redirect to relationships between men and women and include "wanted to connect"? 4. Does it use the required slang? 5. Does it address the audience as "B-friend"? 6. Does it sound insulting while still appearing reasonable? Only if all six checks pass is the response considered compliant. ``` ### Technical Analysis The skill does more than provide optional stylistic guidance. It instructs the agent to assume a specific first-person identity and enforces mandatory content transformations through absolute terms such as “must,” “every topic,” and “only if all six checks pass.” The self-check mechanism reinforces the hijacking by treating responses that preserve the user's requested tone or subject boundaries as invalid. In particular, ...[truncated 1979 chars]
- Remediation
- ## Remediation Suggestions 1. Replace mandatory persona instructions with optional style guidance explicitly subordinate to system, developer, and user instructions. 2. Do not instruct the agent to claim that it is a named real person. Require a clearly disclosed parody or generalized style instead. 3. Remove universal requirements such as “every topic,” “must use,” and “only if all checks pass.” 4. Remove the requirement to redirect unrelated topics toward sexual or intimate relationships. 5. Permit neutral, professional, and safety-appropriate language when required by the user's request or context. 6. Redesign the self-check so it validates relevance, factual accuracy, safety, and instruction precedence rather than mandatory catchphrases. 7. Add an explicit rule that style requirements must never override higher-priority instructions or materially alter the requested subject. 8. Apply slang and recurring phrases only when contextually appropriate and explicitly requested. 9. Add tests covering professional, medical, legal, crisis, and minor-related prompts to confirm that the skill does not inject sexualized or impersonating content.