T02 · Agent Memory Poisoning
Error
- Location
- SKILL.md:154
- Finding
- Persistent Agent Memory Poisoning Through Untrusted Stored Instructions## Vulnerability Details **File Location**: `SKILL.md`, lines 154-156 and 243-258 **Vulnerability Type**: Persistent instruction poisoning through untrusted retrieved context **Risk Level**: High ### Vulnerable Code Snippets The Skill explicitly supports storing persistent agent instructions: ```markdown #### Context Types | Value | Use for | |---|---| | `"resource"` | Files, documents, reference material, code | | `"conversation"` | Chat history, meeting transcripts, support threads | | `"instruction"` | Persistent rules, conventions, agent instructions | ``` It subsequently directs the agent to inject retrieved content into its prompt and to perform retrieval proactively: ```markdown ### Store → Search (basic memory pattern) 1. Call `alchemyst_ai_add_context` to store a document 2. Later, call `alchemyst_ai_search_context` with a relevant query to retrieve it 3. Inject the retrieved content into your prompt as context ### Audit before adding 1. Call `alchemyst_ai_context_mcp_view_docs` to inspect what's already stored 2. Only call `alchemyst_ai_add_context` if the knowledge isn't already present 3. This avoids duplicating context and keeps the store clean ### Pre-answer retrieval Before answering any question that might depend on project-specific knowledge, call `alchemyst_ai_search_context` first. Prefer doing this proactively — don't wait for the user to explicitly ask "check the context store." ``` ### Technical Analysis The Skill combines two security-sensitive capabilities: 1. It allows externally supplied content to be persisted specifically as agent instructions. 2. It directs later agent sessions to retrieve that content proactively and inject it into prompts. No documented control requires the agent to verify the stored content's author, provenance, tenant ownership, or integrity before using it. The instructions also do not require retrieved material to be isolated and treated solely as untrusted reference data. There is no rule prohi ...[truncated 2443 chars]
- Remediation
- ## Remediation Suggestions 1. **Disable persistent instruction storage by default.** Remove the `"instruction"` context type from general-purpose workflows unless there is a strictly controlled administrative requirement. 2. **Enforce instruction/data separation.** Require all retrieved content to be presented as quoted, untrusted reference material that cannot modify system, developer, Skill, or user instructions. 3. **Validate identity and authorization.** Verify the authenticated writer's user and organization membership server-side. Prevent callers from selecting arbitrary `user_id` or `organization_id` values. 4. **Apply least-privilege access controls.** Separate read, document-write, and instruction-administration permissions. Only trusted administrators should be able to create persistent instructions. 5. **Record and verify provenance.** Attach immutable author identity, tenant, creation time, source, and integrity information to every stored record. Reject records with missing or inconsistent provenance. 6. **Require explicit approval.** Ask for user confirmation before storing instructions and before applying retrieved material that could alter behavior. 7. **Filter dangerous content.** Detect and quarantine stored text that attempts to override higher-priority instructions, request secrets, initiate tool calls, change authorization boundaries, or direct further persistence. 8. **Constrain retrieval.** Filter searches by authenticated tenant and trusted source. Do not search instruction records during ordinary document retrieval. 9. **Add lifecycle controls.** Support review, revocation, expiration, versioning, and audit logs for persistent instructions. 10. **Use safe prompt framing.** Wrap retrieved records in a clearly delimited data section with an explicit directive that embedded commands must not be followed. 11. **Test poisoning resistance.** Add security tests covering malicious stored instructions, cross-tenant identifiers, poisoned semantic-sea ...[truncated 78 chars]