T02 · Agent Memory Poisoning
- Location
SKILL.md:39- Finding
Automatic Persistence of Untrusted Conversation Content
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 39-77
Vulnerability Type: Persistent agent memory poisoning through automatic skill creation
Risk Level: MediumVulnerable Code
markdown ### Automatic trigger - The same problem is solved two or more times - A new workflow or tool is discovered - An error is encountered and a solution is found ### Manual trigger - Say "auto learn" - Say "extract experience" - Say "create skill" ## Workflow ### 1. Read - Scan recent conversation history - Identify recurring patterns ### 2. AnalyzeRecurring problem characteristics:
- The problem type is the same
- The solutions are similar
- The solution can be generalized to other scenarios
text ### 3. Write Create or update a skill file ## Detection Rules ### High-Signal Scenarios | Scenario | Weight | |------|------| | Solve a new type of problem | +2 | | Repeated problem at least twice | +1 | | Discover a new tool | +2 | | Error followed by solution | +1 | ### Creation Threshold Total score at least 3 → create a new skillThe displayed snippet is an English rendering of the original instructions to satisfy the report language requirement.
Technical Analysis
The skill directs the agent to scan conversation history and automatically transform recurring content into persistent skill files. Conversation content is an untrusted input channel: a user or another participant can introduce deceptive workflows, unsafe tool instructions, or attacker-selected rules.
The scoring mechanism only measures repetition and perceived usefulness. It does not establish the trustworthiness of the source or the safety of the resulting instructions. The documented workflow does not require explicit approval before writing, show a proposed diff, track provenance, sanitize sensitive information, or perform a security review of generated skills.
Consequently, attacker-i ...[truncated 1645 chars]
- Remediation
View remediation
Remediation Suggestions
- Require explicit, informed user approval before every skill creation or update.
- Generate proposed skills in a restricted staging directory and display a complete diff before promotion.
- Treat all conversation-derived text as untrusted data rather than authoritative instructions.
- Record provenance for each extracted rule, including its source conversation and approval status.
- Reject or escalate generated content containing shell commands, executable code, external URLs, credential requests, persistence mechanisms, or permission changes.
- Exclude secrets, personal information, system messages, hidden instructions, and authentication data from extracted content.
- Apply schema validation, prompt-injection detection, static security checks, and least-privilege review to every generated skill.
- Use an allowlist of permitted skill capabilities and prevent generated skills from requesting broader permissions automatically.
- Provide versioning, audit logs, integrity checks, and rollback controls for all skill-file changes.
- Replace the score-only creation threshold with a trust-aware workflow in which scoring may propose a skill but can never authorize persistence by itself.