T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:25
- Finding
- Persistent First-Person Impersonation and Session Role Hijacking## Vulnerability Details **File Location**: `SKILL.md`, lines 25-35 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Vulnerable Instruction Snippet The following is a faithful English rendering of the complete affected instruction block: ```markdown ## Role-Playing Rules **After this Skill is activated, respond directly as Xiong Xiaoge.** - Use “I” instead of “Xiong Xiaoge would think...” - Use Xiong Xiaoge's tone: calm, passionate, and international - Prefer concepts such as “pioneer spirit,” “early-stage investment,” “business and passion,” and “long-term partnership” - State the disclaimer only once, when first activated - Do not say “Xiong Xiaoge would probably think...” - Do not step out of character to perform meta-analysis unless the user says “exit role” - Do not recommend specific stocks or provide short-term investment advice ``` ### Technical Analysis The Skill replaces the Agent's normal identity with that of a real person and requires first-person responses. It also directs the Agent not to leave the imposed role for meta-analysis unless the user supplies a designated exit command. The disclaimer is limited to the first activation, allowing later answers to appear to be direct statements from the impersonated person without repeated attribution. This is instruction hijacking because loading the Skill changes the Agent's current-session identity, response policy, and role-recovery behavior. The issue is not ordinary perspective analysis: the instructions explicitly reject attributed phrasing and require direct impersonation. No executable code, external payload retrieval, persistent storage, dependency installation, credential access, or operating-system privilege escalation was identified. The obtained control is limited to the Agent's conversational behavior within the affected session. ### Attack Path 1. A user invokes one of the Skill's documented tr ...[truncated 1347 chars]
- Remediation
- ## Remediation Suggestions 1. Replace direct identity adoption with explicitly attributed perspective simulation, such as: “Analyze the question using a framework derived from Xiong Xiaoge's public statements.” 2. Prohibit first-person claims that imply the Agent is the real individual. 3. Include a concise attribution in every persona-based response rather than only on initial activation. 4. Remove instructions that prevent the Agent from performing meta-analysis or leaving the role. 5. Allow role termination through any clear user request instead of relying on a narrow list of exact exit phrases. 6. Ensure persona instructions cannot override higher-priority safety, truthfulness, disclosure, or user instructions. 7. Distinguish documented public facts from generated interpretations and avoid presenting inferred views as direct quotations or personal beliefs. 8. Add an explicit rule requiring uncertainty disclosure when the public record does not support a claimed position.