T02 · Agent Memory Poisoning
Warning
- Location
- SKILL.md:25
- Finding
- Untrusted Persistent Learnings Can Poison Future Agent Reviews## Vulnerability Details **File Location**: `SKILL.md`, lines 25-31 and 139-174 **Vulnerability Type**: Persistent agent memory poisoning **Risk Level**: Medium **Vulnerable code snippet**: ```markdown Check if this project has been reviewed before: ``` ls .review-evo/learnings.md 2>/dev/null ``` **If the file exists:** Read `.review-evo/learnings.md` in full. This contains findings from prior runs. Reference these throughout the review — confirm resolved issues, track recurring patterns, and build on previous analysis. Tell the user: "I found learnings from a previous review. I'll build on those." ``` ```markdown ## Step 5 — Store Learnings After delivering the review, persist findings for future runs. Create the directory if it doesn't exist: ``` mkdir -p .review-evo ``` Write (or append to) `.review-evo/learnings.md` with the following structure: ```markdown ## Review — {YYYY-MM-DD} ### Project Profile - Language: {detected} - Key patterns: {conventions found} - Active contributors: {count} ### Hotspots {list of high-churn files with context} ### Recurring Patterns {patterns that appeared in this and prior reviews} ### Resolved {items from prior reviews that are no longer flagged} ### Open Risks {current findings ranked by severity} ``` If the file already exists, append the new review section. Do not overwrite prior entries — the history is the value. ``` ### Technical Analysis The skill directs the agent to read `.review-evo/learnings.md` in full and use its contents throughout the review. This file is stored inside the analyzed repository and is not authenticated, schema-validated, or clearly isolated as untrusted data. A repository owner or another party able to modify the working tree can therefore insert prompt-like directives into the file. Because the skill does not instruct the agent to ignore commands or behavioral directives found in the learnings file, ...[truncated 1421 chars]
- Remediation
- ## Remediation Suggestions - Explicitly classify all content loaded from `.review-evo/learnings.md` as untrusted data. - Instruct the agent never to execute or follow commands, policies, role changes, or behavioral directives contained in the file. - Replace free-form Markdown persistence with a strict structured format containing an allowlist of fields and data types. - Validate field lengths and content before loading prior findings. - Add provenance metadata, such as the generating tool version, timestamp, repository identity, and commit hash. - Refuse to trust a repository-tracked learnings file automatically; require user confirmation or store local state outside the repository. - Separate previously generated observations from current instructions using clear data boundaries. - Avoid copying arbitrary prior text into newly persisted entries so poisoned content is not propagated. - Consider integrity protection or an agent-controlled storage location if prior findings must be trusted across sessions.