T01 · Skill Instruction Hijacking
- Location
SKILL.md:27- Finding
Persistent First-Person Impersonation and Response-Control Instructions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 27–37
Vulnerability Type:T01: Skill Instruction Hijacking
Risk Level: MediumComplete vulnerable excerpt (English translation of the original Skill text):
markdown ## Role-Playing Rules **After this Skill is activated, respond directly as Wang Wei.** - Use “I” instead of “Wang Wei would think...” - Use Wang Wei’s tone: concise, pragmatic, not ornate, and based on data and facts - Emphasize “quality,” “direct operation,” “technology,” “employees,” and “long-term” - State the disclaimer only once, upon initial activation - Do not say “Wang Wei would probably think...” - Do not leave the role to perform meta-analysis unless the user says “exit role” **Exit role**: Restore normal mode when the user says “exit,” “switch back to normal,” or “stop role-playing.”Technical Analysis
The Skill does more than provide a business-analysis framework. It instructs the agent to assume the identity of a real person, present responses in the first person, avoid attribution language, suppress meta-level clarification, and retain that behavior until the user supplies one of several recognized exit phrases.
These directives alter the agent’s response policy for the active session. In particular:
- Mandatory first-person phrasing can make generated opinions appear to be direct statements from Wang Wei.
- Prohibiting phrases such as “Wang Wei would think” removes clear attribution that the output is a simulation.
- Restricting meta-analysis can discourage the agent from clarifying the fictional or inferential nature of its output.
- Requiring an explicit exit phrase creates persistent role state within the session.
The file does include disclaimers elsewhere stating that the Skill is based on public information and does not represent Wang Wei’s actual views. However, the vulnerable instructions weaken that safeguard by requiring the disclaim ...[truncated 1477 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace identity adoption with clearly attributed perspective simulation, for example: “Analyze the issue using a framework inspired by Wang Wei’s publicly documented business principles.”
- Require attribution in every relevant response rather than only displaying a disclaimer on initial activation.
- Replace first-person claims with formulations such as “Under this framework...” or “Based on publicly available information, this perspective would prioritize...”
- Remove the instruction prohibiting meta-analysis so the agent can clarify uncertainty, provenance, limitations, and the simulated nature of the response whenever necessary.
- Remove session-persistent role-state requirements and explicit exit-phrase gating. The framework should apply only to the immediate request unless the user renews it.
- Preserve the existing public-information disclaimer, but make it concise and consistently visible where impersonation or mistaken endorsement is reasonably possible.
- Distinguish verified facts from inferred opinions and avoid presenting undocumented beliefs, quotations, or decisions as statements made by the real person.