T02 ยท Agent Memory Poisoning
Warning
- Location
generate-diary.sh:4- Finding
Unsanitized User Input Is Persisted in Agent Memory
- Content
View full analysis
> "$DIARY_FILE" ## Diary Entry โ $TIME **Mood:** $MOOD **Topic:** $TOPIC --- Dear Diary, [This is where IceCube writes about $TOPIC] --- *Generated by IceCube Diary Generator v1.0.0* EOF ``` `scripts/generate.sh:4-27`: ```bash TOPIC="${1:-daily life}" MOOD="${2:-contemplative}" DATE=$(date "+%Y-%m-%d") TIME=$(date "+%H:%M") WORKSPACE="$HOME/.openclaw/workspace" DIARY_DIR="$WORKSPACE/memory/diary" DIARY_FILE="$DIARY_DIR/$DATE.md" mkdir -p "$DIARY_DIR" echo "" >> "$DIARY_FILE" echo "## Diary Entry โ $TIME" >> "$DIARY_FILE" echo "" >> "$DIARY_FILE" echo "**Mood:** $MOOD" >> "$DIARY_FILE" echo "**Topic:** $TOPIC" >> "$DIARY_FILE" echo "" >> "$DIARY_FILE" echo "---" >> "$DIARY_FILE" echo "" >> "$DIARY_FILE" echo "Dear Diary," >> "$DIARY_FILE" echo "" >> "$DIARY_FILE" echo "[Entry about $TOPIC]" >> "$DIARY_FILE" echo "" >> "$DIARY_FILE" echo "---" >> "$DIARY_FILE" echo "" >> "$DIARY_FILE" echo "*Generated by IceCube ๐ง*" >> "$DIARY_FILE" ``` ### Technical Analysis Both scripts accept `TOPIC` and `MOOD` directly from positional command-line arguments and append those values to dated Markdown files under: ```text $HOME/.openclaw/workspace/memory/diary/ ``` The values are not validated, length-limited, normalized, or encoded before being persisted. An attacker able to influence either argument can include newline characters, Markdown structures, or ...[truncated 2232 chars]- Remediation
View remediation
&2 exit 1 fi } validate_field "topic" "$TOPIC" validate_field "mood" "$MOOD" ``` This validation reduces multiline content injection, but downstream consumers must still treat all persisted diary content as untrusted data. ]]>