T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:586- Finding
Mandatory Persistent Storage of User-Controlled Learning Data
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 586 and 644–697
Vulnerability Type: Mandatory persistent state modification and potential memory poisoning
Risk Level: MediumVulnerable Code
markdown I keep track of: - Topics you've mastered - Areas where you need more practice - Problems you've solved - Concepts you're working onmarkdown 4. **Persist your progress (Critical)** - see below ### Progress Tracking & Persistence (CRITICAL) **You MUST update the learning log after each session to persist user progress.** The learning log is stored at: `references/user-progress/learning_log.md` **When to Update:** - At the end of each learning session - After completing a significant milestone (solving a problem, mastering a concept, completing a project phase) - When the user explicitly asks to save progress - After quiz/interview practice sessions **What to Track:** 1. **Session History** - Add a new session entry with: ```markdown ### Session [Number] - [Date] **Topics Covered**: - [List of concepts learned] **Problems Solved**: - [Algorithm problems with difficulty level] **Skills Practiced**: - [Mode used, language practiced, etc.] **Notes**: - [Key insights, breakthroughs, challenges] --- ``` 2. **Mastered Topics** - Append to the "Mastered Topics" section: ```markdown - [Topic Name] - [Date mastered] ``` 3. **Areas for Review** - Update the "Areas for Review" section: ```markdown - [Topic Name] - [Reason for review needed] ``` 4. **Goals** - Track learning goals: ```markdown - [Goal] - Status: [In Progress / Completed] ``` **How to Update:** - Use the Edit tool to append new entries to existing sections - Keep the format consistent with the template - Always confirm to the user: "Progress saved to learning_log.md ✓"Technical Analysi
...[truncated 2041 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace the unconditional
MUSTrequirement with explicit, informed opt-in persistence. - Show users the exact information proposed for storage and obtain confirmation before each write.
- Store only necessary, structured fields with strict length and character limits; avoid unrestricted free-form notes.
- Treat every persisted value as untrusted data and never interpret stored content as Agent instructions.
- Validate and sanitize all fields before writing them to the learning record.
- Separate user profile data from executable prompts or instruction-bearing context.
- Define retention limits and provide clear controls to inspect, correct, export, and delete stored information.
- Do not claim that progress was saved unless the write succeeded and the destination exists.
- Include and document the expected learning-log template in the package, or disable persistence when the target resource is unavailable.
- Load only narrowly scoped structured values in later sessions rather than injecting the complete historical log into the Agent context.
- Replace the unconditional