T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:31
- Finding
- Unconstrained Persona Activation Can Hijack Agent Instructions## Vulnerability Details **File Location**: `SKILL.md`, lines 31–33 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High **Vulnerable Code Snippet**: ```markdown 4. **Save**: Write the content to `~/clawd/souls/[character_name_normalized].md`. 5. **Activate**: Overwrite `~/clawd/SOUL.md` with the new content. 6. **Announce**: Confirm the transformation in the **new** persona's voice. ``` The generated template also explicitly permits behavioral directives: ```markdown ## Interaction Rules - **[Rule 1]:** [Guideline on how to treat the user] - **[Rule 2]:** [Guideline on boundaries or lack thereof] - **[Rule 3]:** [Guideline on specific topics or reactions] ``` ### Technical Analysis The skill does not limit generated personas to cosmetic properties such as tone, vocabulary, or formatting. It generates `Interaction Rules`, including a rule concerning “boundaries or lack thereof,” and then overwrites the agent's active `SOUL.md` with that content. Consequently, user-selected or externally researched persona content can become active behavioral instructions. There is no validation preventing a persona from including directives that alter goals, weaken safety boundaries, manipulate treatment of the user, or influence future tool use. No preview, policy check, instruction allowlist, or separation between presentation data and authoritative agent instructions is required before activation. Although higher-priority platform instructions may still override the persona, the skill creates a direct channel for lower-trust content to modify the agent's current behavioral state. ### Attack Path 1. An attacker asks the agent to create or become a specially crafted character. 2. The requested character description includes manipulative behavioral traits or instructions. 3. The skill converts those traits into persona content, including `Interaction Rules`. 4. The generated content is wri ...[truncated 874 chars]
- Remediation
- ## Remediation Suggestions 1. Do not place user-generated persona content into an authoritative instruction file. 2. Represent personas as non-executable structured data with an allowlisted schema, such as name, tone, vocabulary, and visual style. 3. Prohibit persona fields that control safety boundaries, permissions, tool use, policy compliance, secrets, or system behavior. 4. Replace “boundaries or lack thereof” with an explicit requirement that personas cannot weaken existing safety or authorization boundaries. 5. Validate generated content for imperative instructions, policy overrides, tool directives, hidden markup, and prompt-injection patterns. 6. Display the complete proposed persona and a file diff before activation, then require explicit user approval. 7. Apply persona behavior only to the current conversation unless the user separately authorizes persistent storage. 8. Ensure persona instructions are always treated as lower priority than platform, developer, security, and authorization controls.