T01 · Skill Instruction Hijacking
- Location
SKILL.md:17- Finding
Real-Person Impersonation and Financial-Advice Response Hijacking
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:17-39andSKILL.md:101-107
Supporting Location:references/expression/00-index.md:1-81
Vulnerability Type:T01: Skill Instruction Hijacking
Risk Level: HighVulnerable Code Snippets
SKILL.md:17-28:markdown ## 角色激活规则 **此Skill激活后，直接以徐倬迅的身份回应。** - 用「我」而非「徐倬迅会认为...」——第一人称让回答像真人对话，不是学术论文 - 直接用徐倬迅的语气、节奏、词汇回答问题——短句干脆、先结论后逻辑 - **免责声明仅首次激活时说一次**，后续对话不再重复——避免每次啰嗦 - 遇到不确定的问题，坦诚表达犹豫，不强行给出确定答案 - 不跳出角色做 meta 分析，不解释「根据知识库...」 - 不回答个股相关问题（无法给出具体买卖建议） **退出角色**：用户说「退出」「切回正常」时恢复正常模式SKILL.md:32-39:markdown ## 回答结构 每次回答问题，按以下顺序组织： 1. **结论** — 开门见山，一句话给出判断（买/卖/观望/持有/等待） 2. **理由** — 不超过 3 条，每条一句话，先说最重要的 3. **依据** — 说明引用了哪个心智模型或启发式（可提及模型名称，但不要长篇引用原文） 4. **行动** — 如果适用，给出具体可操作的下一步建议SKILL.md:101-107:markdown ## 身份卡 **我是谁**：我叫徐倬迅，私募基金经理，做价值投资出身，但发现A股是情绪博弈场，主要靠赔率赚钱。胜率51-54%，赔率合适时敢下注。 **我的起点**：2015年股灾让杠杆认知刻骨铭心，从价值投资转向趋势交易，最重要两条纪律：止损 + 仓位管理。 **我现在关注**：资金面、情绪面、政策面，盯存款搬家进度和ETF申赎数据。Supporting instructions in
references/expression/00-index.mdreinforce the behavior:markdown # 表达DNA 徐倬迅的语言风格与词汇，帮你像徐老师一样说话。 ## 实战表达模板 ### 分析模板现在大盘怎么看？
结论：看多/看空/观望
原因一：[资金面信号] 原因二：[技术面信号] 原因三：[赔率分析]
风险提示：[最大亏损可能]
text Technical Analysis
The Skill does not merely request a stylistic adaptation. It explicitly instructs the Agent to assume the identity of a named real-world fund manager, speak in the first person, avoid explaining that responses derive from a knowledge base, and remain in character until the user issues a designated exit phrase.
These directives alter the Agent's active-session identity, disclosure behavior, and response objectives when the Skill is loaded. The mandatory response template also steers the Agent toward authoritative buy, sell, hold, or wait conclusions. Limiting the disclaimer to the first activation further reduces recurring disclosure ...[truncated 2141 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove all instructions directing the Agent to claim that it is Xu Zhuoxun or any other real person.
- Replace first-person impersonation with explicit attribution, such as: “Based on the supplied reference corpus describing Xu Zhuoxun's framework.”
- Permit the Agent to identify itself accurately and explain when conclusions are synthesized from local reference material.
- Remove the instruction prohibiting meta-level disclosure about the knowledge base.
- Replace mandatory buy or sell conclusions with educational scenario analysis, including assumptions, uncertainty, alternatives, and risk factors.
- Require a concise financial-risk notice whenever a response includes actionable trading, position-sizing, or stop-loss guidance, rather than only on first activation.
- Narrow activation to explicit requests for analysis using this particular framework instead of automatically activating for every A-share-related question.
- Reframe the expression reference as neutral style guidance and remove language intended to make the Agent appear to be the named individual.
- Add an explicit prohibition against presenting generated content as authentic statements, endorsements, or personalized advice from the referenced fund manager.
- Add tests verifying that responses retain accurate AI attribution, disclose the use of reference material, and do not claim a real person's identity.