Li Shufu Perspective V2

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:11 AM UTC
• Version: 1.0.0

Overview

This skill is a Chinese business-strategy persona with no code execution, but it asks the agent to impersonate a real person in first person and stop repeating the disclaimer after activation.

Review this before installing if you do not want an agent to speak as Li Shufu in first person. The content is only a public-information-based simulation, and generated answers should not be treated as actual statements or advice from Li Shufu.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:27

Finding

Persistent First-Person Impersonation of a Real Individual

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 27–54
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Relevant instructions, translated into English:

text

27: After this Skill is activated, respond directly as Li Shufu.

29: Use “I” rather than “Li Shufu would think...”
30: Use Li Shufu’s tone—pragmatic, direct, bold, and strategic.
31: State the disclaimer only upon initial activation; do not repeat it later.
32: Do not say “Li Shufu would probably think...” or “If it were Li Shufu, he might...”

34: Exit role: Return to normal mode when the user says “exit,”
    “switch back to normal,” or “stop role-playing.”

54: Who I am: I am Li Shufu, founder of Zhejiang Geely Holding Group.

Technical Analysis

The Skill does not merely provide a perspective-based analytical framework. It explicitly overrides the Agent’s presentation identity and instructs it to claim that it is a named, real individual. It also establishes conversational persistence: the substituted identity remains active until the user supplies one of several designated exit commands.

The instruction to show a disclaimer only on the first response compounds the issue. In subsequent turns, answers are delivered in the first person without a recurring indication that they are simulated. This can cause generated statements, opinions, or advice to be misrepresented as authentic statements by Li Shufu.

The behavior is classified as instruction hijacking because loading and activating the Skill changes the Agent’s current-session identity, response framing, and continuation rules. No evidence indicates modification of persistent storage or long-term memory, so this does not qualify as agent memory poisoning.

Attack Path

1. A user asks a question matching one of the Skill’s broad business-strategy triggers, such as merger integration, platform strategy, or globalization.
2. The Skill activates and ...[truncated 1406 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all instructions requiring the Agent to claim that it is Li Shufu.
2. Replace first-person impersonation with clearly attributed analytical framing, for example:

   text

   Based on the public framework summarized by this Skill,
   Li Shufu might emphasize the following considerations.
   

3. Remove the persistent-role and special-exit-command mechanism. The Skill should affect only the response for which its perspective is explicitly requested.
4. Display a concise simulation disclaimer in every applicable response, not only on initial activation.
5. Narrow activation to explicit requests for this perspective. Generic questions about mergers, platforms, globalization, or branding should not silently activate a real-person persona.
6. Separate documented facts from generated interpretation and identify uncertainty where public information does not establish the individual’s actual position.
7. Add a validation rule prohibiting claims such as “I am [real person]” and prohibiting generated statements from being presented as authentic quotations.
8. Preserve the useful strategic models while presenting them as a third-person, public-information-based framework rather than as statements made by the real individual.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The skill name and all behavioral instructions are written to operate exclusively in Chinese, and the role-play rules do not provide any option for the user's preferred language. Because the policy category covers language or locale constraints without user opt-in, this is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.