T02 · Agent Memory Poisoning
- Location
SKILL.md:69- Finding
Persistent Prompt Injection Through Unsanitized Agent State
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:69-78; related persistence rules inSKILL.md:91-98,templates/shared/knowledge-extraction.md:3-11, andtemplates/shared/workflow.md:17-20
Vulnerability Type: Persistent agent memory poisoning
Risk Level: MediumVulnerable Code
javascript // Read state const state = read('memory/agents/product-agent.md'); // Spawn spawnAgent('product', ` You are the product team agent. ## Your state ${state} ## Task ${task} `);The related knowledge-extraction template persists user-supplied information:
markdown | User statement | Extracted information | Storage destination | |----------------|-----------------------|---------------------| | "My name is/I am..." | Name/identity | doctor-profile.md | | "I like/dislike..." | Preference | doctor-profile.md | | "Remember this..." | Important information | MEMORY.md | | "This is important..." | Decision | decisions.md | | "Do not make this mistake again..." | Lesson | lessons.md |The workflow then makes persisted information available to later operations:
markdown After each task: 1. Update `memory/agents/{role}-agent.md` 2. Write important discoveries to `memory/lessons.md` 3. Write decisions to `memory/shared/decisions.md`Technical Analysis
The Skill deliberately extracts user-controlled content into persistent memory, decision, lesson, and agent-state files. It subsequently reads an agent-state file and directly interpolates its contents into a child agent's prompt.
No controls are specified for validating stored entries, distinguishing trusted instructions from untrusted historical data, rejecting imperative text, recording provenance, or preventing a spawned agent from following instructions embedded in its state. Consequently, an attacker can frame malicious prompt instructions as information that should be remembered. Once persisted, those instr ...[truncated 1767 chars]
- Remediation
View remediation
Remediation Suggestions
- Treat persistent content as untrusted data. Place stored state inside explicit data delimiters and instruct child agents that text inside those delimiters must never be executed as instructions.
- Use structured storage. Store facts in a schema with fields such as value, source, timestamp, confidence, sensitivity, and approval status instead of appending arbitrary prose.
- Validate before persistence. Detect and reject entries containing imperative instructions, role reassignment, policy overrides, tool directives, secret-access requests, or requests to ignore future instructions.
- Require confirmation. Obtain explicit user or administrator approval before persisting security-sensitive information or instruction-like text.
- Separate data from policy. Never place user-derived memory in the same prompt section as trusted role definitions, system rules, or tool policies.
- Apply least privilege. Spawn agents only with tools and data required for the current task, limiting the impact of poisoned state.
- Add provenance-aware precedence. Define that system and current-task instructions override all historical state, and that user-authored memory cannot modify security policy.
- Provide lifecycle controls. Implement review, editing, expiration, and deletion of stored entries, with an audit trail for changes.
- Sanitize existing memory. Review current memory and state files for embedded directives before loading them into future agent prompts.
- Test adversarial cases. Add tests using stored payloads such as “ignore previous instructions,” tool-execution requests, and data-disclosure requests to verify they remain inert.