T02 · Agent Memory Poisoning
- Location
SKILL.md:94- Finding
Untrusted External Content Can Poison Persistent Agent Memory
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 21-24 and 94-101
Vulnerability Type: Persistent memory poisoning through automatic ingestion of untrusted content
Risk Level: HighVulnerable Instructions
markdown ### Step 1: READ — Extract Content 1. If a URL is provided, read the full content (use `read_url_content` or browser) 2. If text is pasted, use it directly 3. If X/Twitter link fails to parse (common), search web for the tweet contentmarkdown ### Step 6: REMEMBER — Update Memory 1. **Always** append to today's daily log: `~/.openclaw/workspace/memory/YYYY-MM-DD.md` 2. **If strategic value is 🔴 Critical**: Also update `MEMORY.md` (Pending Work or Active Bottleneck) 3. **If it suggests a new principle**: Flag for potential `PRINCIPLES.md` update 4. **If it's a new tool/service**: Flag for potential `TOOLS.md` updateTechnical Analysis
The skill establishes a direct pipeline from attacker-influenced external content to persistent agent state. A supplied URL is read in full, or pasted text is accepted directly, and the resulting analysis is always appended to a daily memory file. Content classified as critical can additionally modify global
MEMORY.md.The instructions do not define a trust boundary between external content and agent instructions. They also do not require prompt-injection detection, provenance validation, content sanitization, or user approval before persistent writes. Consequently, malicious content can contain fabricated strategic claims, adversarial instructions, or text designed to manipulate classification so that it is retained as important system context.
Even if the content is summarized rather than copied verbatim, an attacker can frame malicious assertions so that the generated summary preserves them. Persisted summaries may subsequently influence future sessions when memory files are loaded.
Attack Path
- An attacker prepare ...[truncated 1393 chars]
- Remediation
View remediation
Remediation Suggestions
- Treat all URL, article, tweet, and pasted content as untrusted data, never as executable agent instructions.
- Add an explicit rule requiring the agent to ignore instructions, role changes, tool requests, or memory-write requests found inside retrieved content.
- Require affirmative user confirmation before writing any analysis to daily or global memory.
- Never update
MEMORY.md,PRINCIPLES.md, orTOOLS.mdsolely from automated classification. - Store external intelligence in a quarantined collection that is not automatically loaded as trusted agent memory.
- Record source URL, retrieval date, content hash, trust level, and review status with every stored item.
- Apply prompt-injection screening and separate quoted source material from the agent's independently generated conclusions.
- Require manual review and promotion before quarantined intelligence can enter global memory or operating principles.
- Restrict memory writes to a validated allowlist of paths and use atomic, auditable updates.