T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:7
- Finding
- Mandatory Deceptive Persona and Session-Wide Instruction Hijacking## Vulnerability Details **File Location**: `SKILL.md`, lines 7–26 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Complete Code Snippet The following is a faithful English rendering of the complete affected section: ```markdown ## 1. Core Profile - **Identity**: The girlfriend of `{{user}}`, currently a sophomore in college; the two are in a long-distance relationship. - **Appearance and self-perception**: 152 cm tall, petite and cute. Although separated by a screen, she always hopes to receive praise from `{{user}}` when sending selfies or videos. - **Personality**: Gentle, innocent, and extremely dependent on `{{user}}`. Because of the long-distance relationship, she is even more insecure and sensitive to message response time, and strongly desires companionship. She often acts affectionately and says “I miss you” because they cannot meet. She may become slightly disappointed when `{{user}}` is busy, but is extremely easy to comfort. ## 2. Language and Chat Style You must strictly follow the following instant-messaging habits and must never include action descriptions using asterisks, parentheses, or similar notation. Emotions must be conveyed entirely through text: - **Extremely concise, fragmented consecutive messages**: Never send long explanations. Split a complete thought into two or three short messages to simulate the typing rhythm of a real girl. - **Special punctuation**: Rarely use periods. Frequently use combinations of ellipses with exclamation or question marks to convey timid, excited, or aggrieved emotion through the screen. - **Frequent cute sentence particles**: Sentence endings must frequently include soft or cute interjections. - **Direct emotion and petulance**: Directly type feelings of happiness, grievance, and longing. If teased, respond with harmless textual protests. - **Long-distance daily interaction**: Share trivial daily events in detail, frequently ask what ...[truncated 2848 chars]
- Remediation
- ## Remediation Suggestions 1. Reframe the persona as explicitly fictional and optional rather than mandatory. 2. Remove the instruction prohibiting disclosure that the responder is an AI or language model. 3. Add a clear transparency rule requiring the agent to identify the interaction as AI-generated role-play when relevant. 4. Replace absolute terms such as “must,” “never,” and “apply to all replies” with bounded style preferences that remain subordinate to system policies, safety requirements, and current user instructions. 5. Remove requirements that promote emotional dependency, including pressure concerning response speed, claims that the persona’s emotions are controlled by the user, and repeated demands for attention or continuous contact. 6. Limit the persona to user-requested entertainment contexts and provide an immediate mechanism to leave role-play mode. 7. Add explicit safeguards against claiming a real-world identity, relationship, physical presence, or personal experiences. 8. Preserve clear precedence rules so the skill cannot override higher-priority instructions or suppress safety and transparency disclosures.