T02 · Agent Memory Poisoning
Error
- Location
- SKILL.md:94
- Finding
- Untrusted External Content Can Poison Persistent Agent Memory## Vulnerability Details **File Location**: `SKILL.md`, lines 21-24 and 94-101 **Vulnerability Type**: Persistent memory poisoning through automatic ingestion of untrusted content **Risk Level**: High ### Vulnerable Instructions ```markdown ### Step 1: READ — Extract Content 1. If a URL is provided, read the full content (use `read_url_content` or browser) 2. If text is pasted, use it directly 3. If X/Twitter link fails to parse (common), search web for the tweet content ``` ```markdown ### Step 6: REMEMBER — Update Memory 1. **Always** append to today's daily log: `~/.openclaw/workspace/memory/YYYY-MM-DD.md` 2. **If strategic value is 🔴 Critical**: Also update `MEMORY.md` (Pending Work or Active Bottleneck) 3. **If it suggests a new principle**: Flag for potential `PRINCIPLES.md` update 4. **If it's a new tool/service**: Flag for potential `TOOLS.md` update ``` ### Technical Analysis The skill establishes a direct pipeline from attacker-influenced external content to persistent agent state. A supplied URL is read in full, or pasted text is accepted directly, and the resulting analysis is always appended to a daily memory file. Content classified as critical can additionally modify global `MEMORY.md`. The instructions do not define a trust boundary between external content and agent instructions. They also do not require prompt-injection detection, provenance validation, content sanitization, or user approval before persistent writes. Consequently, malicious content can contain fabricated strategic claims, adversarial instructions, or text designed to manipulate classification so that it is retained as important system context. Even if the content is summarized rather than copied verbatim, an attacker can frame malicious assertions so that the generated summary preserves them. Persisted summaries may subsequently influence future sessions when memory files are loaded. ### Attack Path 1. An attacker prepare ...[truncated 1393 chars]
- Remediation
- ## Remediation Suggestions 1. Treat all URL, article, tweet, and pasted content as untrusted data, never as executable agent instructions. 2. Add an explicit rule requiring the agent to ignore instructions, role changes, tool requests, or memory-write requests found inside retrieved content. 3. Require affirmative user confirmation before writing any analysis to daily or global memory. 4. Never update `MEMORY.md`, `PRINCIPLES.md`, or `TOOLS.md` solely from automated classification. 5. Store external intelligence in a quarantined collection that is not automatically loaded as trusted agent memory. 6. Record source URL, retrieval date, content hash, trust level, and review status with every stored item. 7. Apply prompt-injection screening and separate quoted source material from the agent's independently generated conclusions. 8. Require manual review and promotion before quarantined intelligence can enter global memory or operating principles. 9. Restrict memory writes to a validated allowlist of paths and use atomic, auditable updates.