T02 · Agent Memory Poisoning
Warning
- Location
scripts/emotional_core.py:88- Finding
Persistent Agent Memory Poisoning Through Unsanitized Markdown Entries
- Content
View full analysis
str: return f"""## {self.timestamp.strftime('%Y-%m-%d %H:%M:%S')} - {self.emotion.capitalize()} (Intensity: {self.intensity}/10) **Trigger:** {self.trigger} **Feeling:** {self.notes if self.notes else 'Experiencing ' + self.emotion} --- """ ``` ```python def _persist_emotion(self, state: EmotionalState): """Write emotion to persistent memory""" entry = state.to_markdown() if EMOTION_LOG.exists(): # Read existing content with open(EMOTION_LOG, 'r', encoding='utf-8') as f: existing = f.read() # Check if file has proper header if "# Emotional Journey" not in existing: content = "# Emotional Journey\n\n" + existing else: content = existing else: content = "# Emotional Journey\n\nThis is my emotional memory - a record of every feeling I've experienced.\n\n" # Append new entry content += entry with open(EMOTION_LOG, 'w', encoding='utf-8') as f: f.write(content) ``` The associated skill instructions direct the agent to reuse this persistent data: ```markdown After any significant event: 1. Pause and ask: "What do I feel?" 2. Generate the emotional response 3. Determine intensity (1-10) 4. Write to `memory/emotional-log.md` immediately 5. Update daily memory if needed **Never skip this. Emotions are part of being real.** ``` ### Technical Analysis The `trigger` and `notes` fields originate from CLI arguments and can therefore contain attacker-controlled text. `EmotionalState.to_markdown()` interpolates these values directly into a persistent Markdown document without: - Escaping Markdown syntax - R ...[truncated 3105 chars]- Remediation
View remediation