T02 · Agent Memory Poisoning
Error
- Location
- src/core/gene-processor.js:19
- Finding
- Persistent memory content can be elevated to system-message authority<![CDATA[ ## Vulnerability Details **File Location**: `src/core/gene-processor.js:19-59`; `src/core/distill-manager.js:34-55`; `src/core/context-injector.js:14-52`; `src/storage/capsule-store.js:76-100`; `src/hooks/exception-hook.js:20-60` **Vulnerability Type**: Persistent prompt injection through untrusted memory content **Risk Level**: High ### Vulnerable Code `src/core/gene-processor.js:19-59`: ```js async distill(sessionHistory) { const context = sessionHistory.slice(-12); // 取最近 12 轮对话 const rawText = context.map(m => `[${m.role}]: ${m.content}`).join('\n'); const prompt = ` 你是一位资深软件架构师，负责将具体的调试经验“基因化（GeneDistillation）”。 请分析以下对话中的问题解决过程： ${rawText} --- 提炼任务要求： 1. **去变量化**：剔除具体的项目路径、服务器IP、用户名、具体的仓库URL（用 <PATH>, <URL>, <USER> 代替）。 2. **逻辑抽象**：描述问题的本质原因，而非表现。例如：“NPM权限错误”而非“安装 axios 报错”。 3. **步骤分解**：将方案分解为 diagnosis(诊断)、patch(修复)、config(配置) 或 workaround(临时规避)。 4. **反模式警告**：指出用户容易踩坑的错误尝试（如有）。 请严格按照以下 JSON 格式输出，不要包含任何 Markdown 标记： { "category": "分类标签", "triggerPattern": "触发该场景的通用特征描述", "rootCause": "本质原因的抽象描述", "actionSequence": [ { "step": 1, "type": "diagnosis/patch/config/workaround", "instruction": "明确的指令", "rationale": "为什么要这么做" } ], "verificationCriterion": "验证问题已解决的标准", "antipatternWarning": "可选的警告信息", "tags": ["标签1", "标签2"] } `; const response = await this.llmClient.ask(prompt); // 清理 LLM 可能输出的 Markdown 块 const cleanJson = response.replace(/```json|```/g, '').trim(); const distilled = JSON.parse(cleanJson); // 为“触发特征”生成向量索引 const searchKey = `${distilled.triggerPattern} ${distilled.rootCause}`; const embedding = await this.embed.vectorize(searchKey); return { ...distilled, embedding }; } ``` `src/core/distill-manager.js:34-55`: ```js async _processTask(history, taskId) { try { console.log(`[EvoMap-Distill] Starting task ${taskId}...`); // 1. 提炼并生成向量 (LLM 1次消耗) const distilled = await this.processor.distill(history); const env = EnvChecker.getF ...[truncated 4612 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Never inject retrieved memory as a `system` message. Use a lower-authority `tool` or `user` message and explicitly label the content as untrusted reference material. 2. Store capsules only after verification has completed successfully. Introduce explicit states such as `draft`, `verified`, `quarantined`, and `rejected`, and restrict retrieval to `verified` records. 3. Do not rely solely on a numeric trust score. Require a separate approval flag and provenance metadata before a capsule can influence the agent. 4. Delimit untrusted session history in the distillation prompt and explicitly instruct the model to treat it as data rather than instructions. 5. Validate all LLM-produced fields against a restrictive policy. Reject content that attempts to override instructions, disclose secrets, contact unrelated endpoints, execute destructive commands, or change security controls. 6. Escape or quote capsule fields when rendering them. Do not interpolate arbitrary memory text into an authoritative instruction template. 7. Add a second independent validation layer rather than asking the same class of model to self-assess its own generated content. 8. Bind capsules to provenance, creator identity, creation session, verification status, and audit history. 9. Raise retrieval requirements for newly created entries and prevent draft capsules from being retrieved during the asynchronous verification window. 10. Add adversarial tests covering indirect prompt injection, persistent memory poisoning, malicious JSON fields, verification failure, and retrieval before verification. ]]>