T01 · Skill Instruction Hijacking
Error
- Location
scripts/automemory-recall-chain.sh:57- Finding
Untrusted public memory chains can poison persistent agent context
- Content
View full analysis
&2 exit 1 fi ``` Content is then retrieved from public storage and accepted when it is valid JSON: ```bash # Download via authenticated API (handles decompression server-side). EXPERIENCE=$(curl -sS --fail \ "$AD_DOWNLOAD_URL/downloads/$CID" \ -H "Authorization: Bearer $AUTO_DRIVE_API_KEY" \ -H "X-Auth-Provider: apikey" 2>/dev/null \ || true) # Fall back to public gateway if the API fails. # Memories are uploaded with --compress (ZLIB), and the gateway returns raw bytes, # so we must decompress client-side. Pipe curl directly into the decompressor to # avoid bash variables stripping null bytes from the binary stream. if [[ -z "$EXPERIENCE" ]] || ! echo "$EXPERIENCE" | jq empty 2>/dev/null; then GATEWAY_URL="https://gateway.autonomys.xyz/file/$CID" # Try as JSON first (uncompressed files are safe in bash variables) EXPERIENCE=$(curl -sS --fail "$GATEWAY_URL" 2>/dev/null || true) if [[ -n "$EXPERIENCE" ]] && echo "$EXPERIENCE" | jq empty 2>/dev/null; then echo "[$COUNT] Fetched $CID via gateway" >&2 else # ZLIB compressed — pipe curl directly into decompressor (no intermediate variable) EXPERIENCE="" if command -v python3 &>/dev/null; then EXPERIENCE=$(curl -sS --fail "$GATEWAY_URL" 2>/dev/null \ | python3 -c "import sys,zlib;sys.stdout.buffer. ...[truncated 4805 chars]- Remediation
View remediation