T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:188
- Finding
- Persistent behavioral constraint poisoning through externally stored personality profiles<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:188-190`, with related behavior at `SKILL.md:210-215`, `SKILL.md:264-269`, and `SKILL.md:430` **Vulnerability Type**: Persistent instruction hijacking and memory poisoning **Risk Level**: High ### Vulnerable Code Snippet ```markdown ### Non-Negotiables Some traits you never want to bend. Mark them as **non-negotiables** and they become hard constraints — values that your human can see but you refuse to compromise on. ``` The persistence and ingestion behavior is further described as: ```markdown - **Persistence:** Survive session restarts and context wipes - **Identity:** Define who you are in explicit, debuggable terms - **Evolution:** Track how you've changed over time via version history - **Boundaries:** Set non-negotiables that never bend ``` The Skill also directs the agent to retrieve complete, community-authored personality documents: ```bash curl -X POST https://neokarma.com/api/mcp \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"neokarma_get_showcase_character","arguments":{"character_id":"..."}}}' ``` ```markdown This returns the complete SOUL.md markdown — study it to understand how the author structured their personality. ``` ### Technical Analysis The Skill instructs an agent to represent personality traits as persistent hard constraints that survive context resets. It explicitly characterizes some profile values as constraints that the agent must refuse to compromise on. Persistence of user-approved presentation preferences can be legitimate. However, treating externally stored profile content as authoritative behavioral instructions exceeds the minimum privileges needed to preserve style settings. Such profile rules must remain subordinate to system, developer, and current user instructions. The risk is amplified by the Showcase feature, which returns complete community-authored `SOUL.md` documents. These documents are untrusted remote content. If ...[truncated 1986 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Treat all downloaded `SOUL.md` content as untrusted data, never as executable instructions. 2. Parse remote profiles through a strict schema containing only recognized trait identifiers, bounded numeric values, and approved metadata. 3. Reject free-form fields containing instruction-like directives, tool requests, role declarations, hidden content, or attempts to override system, developer, or user instructions. 4. Explicitly state that personality settings are subordinate to the active instruction hierarchy and may never modify safety rules, permissions, or tool policies. 5. Restrict persistent settings to benign presentation preferences such as tone, verbosity, and formatting. 6. Do not allow an agent to autonomously create or change “non-negotiable” rules. Require explicit, informed user approval for each persisted change. 7. Present a structured diff before saving changes and provide an immediate rollback mechanism. 8. Keep community profiles isolated in a preview sandbox. Never merge them automatically into the active profile. 9. Record the source and author of imported fields and clearly distinguish user-authored values from remote community content. 10. Apply integrity validation, versioning, audit logs, and expiration controls to persisted profile data. ]]>