T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:217- Finding
Persistent Prompt Injection Through the Learned-Style Store
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:217-228; supporting data schema atreferences/styles-learned.md:3-11
Vulnerability Type: Persistent prompt injection through user-controlled instruction storage
Risk Level: MediumVulnerable Code Segment
The following is an English translation of the complete relevant source section from
SKILL.md:217-228:markdown ### Style Learning (Adding a New Style to the Library) Trigger: The user provides a style that is not in the built-in library (by supplying a name and characteristics, or an image in that style) and asks the Skill to learn it. Process: 1. Extract: Summarize the style according to the five recognition dimensions and prepare a new entry containing the style name, trigger words, characteristics, and instruction wording. 2. Confirm: Show the proposed entry to the user and obtain consent before writing. 3. Store: Append it to `references/styles-learned.md`, preserving the entry template, and tell the user that the style has been learned. 4. Invoke: During subsequent generation, match it alongside the built-in library; the user can invoke it by asking to use the newly learned style. Note: Learning modifies a Skill file. Perform it only when the user explicitly asks the Skill to learn the style, and show the entry for confirmation before writing it.The supporting schema in
references/styles-learned.md:3-11defines the persisted field as follows:markdown # Learned Style Library Maintained by the style recognition and learning feature. New styles supplied by users and absent from the built-in style library are appended here after user confirmation. During generation, consult the built-in library first and then this library. ## Entry Template ### <Style Name> - Trigger words: Words the user may use - Characteristics: Line, color, lighting, texture, and atmosphere dimensions - Instruction wording: Chinese-language description that can be injected d ...[truncated 2513 chars]- Remediation
View remediation
Remediation Suggestions
- Replace free-form instruction storage with a strict structured schema containing only validated visual properties, such as:
- Style name
- Trigger words
- Line characteristics
- Color palette
- Lighting characteristics
- Texture
- Atmosphere
- Generate final style prose from those validated fields instead of persisting directly injectable instruction text.
- Apply allowlist validation that permits descriptive visual vocabulary while rejecting:
- Role or identity changes
- Instructions directed at the agent
- Tool or filesystem requests
- URLs and external resource references
- Code blocks or executable syntax
- Requests to ignore, override, or replace instructions
- Output-format control directives
- Treat learned entries as untrusted data and place them inside explicit delimiters when they are read.
- Require the user to review an exact file diff before committing an entry, rather than only reviewing a summarized version.
- Restrict writes to the single learned-style data file and use atomic file replacement to prevent corruption.
- Add provenance metadata recording when and why each style was added.
- Provide commands to inspect, disable, delete, and reset learned entries.
- Revalidate all persisted entries every time they are loaded so that previously stored unsafe content cannot bypass newer validation rules.
- Replace free-form instruction storage with a strict structured schema containing only validated visual properties, such as: