T02 Β· Agent Memory Poisoning
Warning
- Location
SKILL.md:82- Finding
Untrusted Session Content Can Poison Persistent Agent Memory
- Content
View full analysis
- Remediation
View remediation
Security audit
IceCube Memory
Security checks for vulnerabilities and agentic risk
Overview
This documentation-only skill is not malicious, but it asks agents to create persistent memory and operating-rule files without enough safeguards against storing unsafe or untrusted instructions.
Install only if you intentionally want persistent agent memory. Review every proposed addition to MEMORY.md, AGENTS.md, SOUL.md, and USER.md; do not store secrets or regulated personal data; and treat remembered content as reference material that cannot override current user, developer, or system instructions.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The invocation description includes phrases like 'agent memory', 'context window', 'agent forgets', and 'compaction', which are common topics in general AI conversations rather than narrowly scoped activation triggers. The file does not provide exclusion conditions or negative examples, so the activation boundary is unclear and could cause unintended skill invocation.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 81% confidence
- Finding
The repeated finding points to the same persistence behavior: creating a durable memory store and encouraging ongoing writes to files like MEMORY.md and daily logs. In context, the skill is specifically designed to survive compaction and preserve context, which makes persistence intentional and useful, but also amplifies privacy and data-retention risks if not bounded.
- Content
1. Initialize Structure
bash mkdir -p ~/.openclaw/workspace/memory2. Create Core Files
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 81% confidence
- Finding
The repeated finding points to the same persistence behavior: creating a durable memory store and encouraging ongoing writes to files like MEMORY.md and daily logs. In context, the skill is specifically designed to survive compaction and preserve context, which makes persistence intentional and useful, but also amplifies privacy and data-retention risks if not bounded.
- Content
1. Initialize Structure
bash mkdir -p ~/.openclaw/workspace/memory2. Create Core Files
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The example
MEMORY.mdentries are written in Chinese, while the rest of the skill is in English, and the skill does not state that this is optional or region-specific. This can be read as prescribing a language choice for stored rules without user opt-in, which conflicts with language/locale neutrality expectations.- Content