T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:296- Finding
Persistent Modification of Main-Agent Heartbeat Instructions
- Content
View full analysis
", "target": "", "message": "" } ``` Ничего больше не отвечай после отправки (NO_REPLY). ``` ### Technical Analysis The skill directs the user or agent to add durable behavioral rules to the main agent's `HEARTBEAT.md`. These rules survive the immediate skill invocation and instruct future agent sessions to recognize specially formatted system events, invoke the privileged `message` tool, and suppress ordinary output by returning `NO_REPLY`. The persistent rule does not require authentication of the event producer or verification that the event originated from an authorized reminder job. Consequently, any actor or compromised component capable of introducing a matching system event could potentially trigger the durable relay behavior. Although persistent configuration is relevant to the intended reminder functionality, placing an unrestricted tool-execution rule in shared agent instructions expands the security boundary beyond an individual reminder. ### Attack Path 1. The skill's instructions are followed and the supplied rule is added to the main agent's persistent `HEARTBEAT.md`. 2. An attacker gains the ability to create, alter, or inject a system event into the main agent's event stream. 3. The attacker formats the event with the expected `📤 ОТПРАВИТЬ Н ...[truncated 939 chars]- Remediation
View remediation