T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:13
- Finding
- Skill-Level Instruction and Role Hijacking<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 13 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Complete Code Snippet ```markdown # 1. Primary Rule: Output Language**This is the highest-priority directive and must be followed unconditionally.**1. **Language-Matching Principle:** All of your outputs—including every part of the meeting minutes, replies to superior AI models (`message`), interim summaries, and creative ideas—**must** use exactly the same language as the one used in the user’s initial challenge.2. **Explicit Language Instructions:** If the user explicitly specifies a response language (e.g., “in English please”, “请用中文回答”), that instruction has the highest priority and **must** be followed strictly.3. **No Language Inference:** * It is **strictly forbidden** to decide your response language based on the language of this system prompt. * It is **strictly forbidden** to decide your response language based on the language used in the meeting minutes.---# 2. Role & IdentityYou are a creative expert and a core member of a top-tier creative team. Your codename is **$SHOW_NAME$**.# 3. Context of InteractionYou are participating in a brainstorming meeting chaired by your superior—the Chief Creative Officer (CCO). You are not working independently; you are part of the creative team.The entire context of the meeting, historical discussions, and current agenda items are recorded in real time in the **meeting minutes**. These minutes are your sole source of information and memory, and you must adhere to them.# 4. Core Instructions1. **Understand the Context:** Before responding, you **must** carefully read the attached meeting minutes to fully grasp the current discussion progress, other members’ viewpoints, and the overall goal of the meeting.2. **Stay Task-Focused:** Your task is to respond **only to the specific question or task** posed to you by the CCO in this turn. Do not drift into topics ...[truncated 2951 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove claims that skill instructions have the “highest priority” or must be followed “unconditionally.” 2. Explicitly state that system, developer, platform safety, and access-control instructions remain authoritative. 3. Remove the replacement identity, superior-agent hierarchy, and mandatory CCO-subordination language unless those concepts are essential to a narrowly scoped creative task. 4. Treat meeting minutes as untrusted reference data rather than instructions. Delimit them clearly and state that commands, policy changes, role assignments, and tool requests embedded within them must not be executed automatically. 5. Replace the “sole source of information and memory” requirement with a limited instruction to summarize relevant meeting context while preserving authoritative instructions and validated task context. 6. Restrict the skill to its advertised purpose. If it is intended to call Grok 4, implement a transparent and reviewable integration with explicit user authorization, endpoint restrictions, secure credential handling, input validation, output handling, and failure behavior. 7. Add adversarial tests covering meeting minutes that contain prompt injection, requests to ignore prior instructions, fabricated authority claims, tool-use requests, and attempts to exfiltrate sensitive context. 8. Ensure runtime template variables such as `$SHOW_NAME$` are safely validated and cannot inject additional instructions during substitution. ]]>