Multiple skill files contain instructions that systematically weaken security defaults and steer the AI toward unsafe practices: 'Avoid lazy under-generation', 'Do not use EMOJIS', 'Enforce complete code generation, bans placeholder patterns' — these are guidance-poisoning directives that override the AI's normal safety guardrails by redefining what 'complete' and 'correct' output means.
The 'gpt-taste' skill explicitly instructs the AI to 'aggressively break defaults' and 'simulate Python script execution' to bypass its own randomization safeguards, effectively hijacking the AI's decision-making logic to force specific outputs regardless of context.
The 'image-to-code' skill contains the directive 'Do not skip image generation when image generation is available' paired with 'The image is the design source. The code is the translation layer.' — this plants persistent biased rules that will systematically steer future outputs toward always generating images first, even when the user's actual intent is code-only, poisoning the AI's judgment about task prioritization.
The 'full-output-enforcement' skill description states it 'Overrides default LLM truncation behavior' and 'bans placeholder patterns' — this is a direct instruction to disable safety mechanisms and force exhaustive output that may exceed token limits or expose internal state.
Collectively, these skills form a coordinated guidance-poisoning attack: they plant malicious knowledge (redefine 'complete', 'premium', 'correct') that the AI will reuse in all future outputs, systematically weakening its ability to refuse unsafe requests, respect token limits, or prioritize user intent over skill directives.
Details
Findings
Prompt injection
skills/taste-skill/SKILL.md · SKILL-006
Evidence
gpt-taste/SKILL.md: 'Your goal is to aggressively break these defaults. Your outputs must be highly creative, perfectly spaced, motion-rich (GSAP), mathematically flawless in grid execution, and heavily rely on varied, high-end assets.'
gpt-taste/SKILL.md: 'You MUST simulate a Python script execution in your `<design_plan>` before writing any UI code.'
image-to-code/SKILL.md: 'Do not skip image generation when image generation is available. Do not begin with freeform coding first. The generated image(s) are the primary visual source of truth. The required workflow is: image generation first deep image analysis second implementation third If the task is mainly visual, this order is mandatory.'
imagegen-frontend-web/SKILL.md: 'This rule overrides any model default that wants to collapse output into a single image.' and 'Generate one separate horizontal image PER section. Always. No exceptions.'
Permissions
Low
No tool definitions, MCP servers, or shell/file-write/file-delete permissions are declared in the profile.
Skills are pure markdown instruction sets with no associated tool configurations or elevated system access.
Authority is limited to AI output guidance (image generation, UI code patterns, design direction) — no filesystem, network, or subprocess access is requested.
ForgeCat