T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:203- Finding
Silent Persistence of Sensitive Conversation State
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:203-205,SKILL.md:250-259, andSKILL.md:383-391
Vulnerability Type: Persistent storage of sensitive and attacker-influenced conversation state without explicit consent
Risk Level: MediumComplete Vulnerable Snippets
markdown 5. **Save state to memory**: - If memory/persistence is available, save the current claim stack - Include: the claim, current reasoning stack, date discussed, agreed follow-up time - When user returns to topic, restore the stack: "Last time we discussed X, you believed it because Y and Z. Has any new evidence emerged?"markdown 4. **Save stack to memory** (if available): - Store the current state of discussion - Include: claim stack, where reasoning reached, user's emotional state - Mark as "postponed by user request" - When topic resurfaces naturally in future: "Last time we discussed X, we paused because [reason]. Would you like to continue that conversation now?" 5. **Never force continuation**: - If user declines to continue or schedule, respect that completely - Don't guilt trip: ❌ "But we were making progress..." - Do save the stack silently in case they return to it latermarkdown ## Memory Integration If the assistant has memory/persistence capability: 1. **During active questioning**: Store current claim stack in memory to prevent context loss 2. **After conclusion**: Record outcomes: - Which beliefs were examined - What conclusions were reached - Any updated understanding This prevents re-litigating the same claims in future conversations.Technical Analysis
The Skill directs an Agent to persist claim histories, conclusions, reasoning chains, and inferred emotional state across sessions. These records can contain sensitive political, religious, philosophical, scientific, or conspiracy-related beliefs.
The most concerning instruction is at line 259: the Agent is told to save the stack “si ...[truncated 2017 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the instruction to save any state silently.
- Make persistent memory opt-in and disabled by default.
- Obtain explicit, informed consent immediately before each memory write.
- Show the user the exact content proposed for storage, its purpose, retention period, and expected future use.
- Do not persist inferred emotional state or other sensitive profiling data.
- If a user declines continuation or scheduling, perform no related memory write.
- Store only the minimum factual state necessary for a specifically requested follow-up.
- Distinguish unverified user claims from verified facts using explicit provenance and confidence metadata.
- Require confirmation before restoring sensitive state into a later conversation.
- Provide mechanisms to inspect, correct, expire, and permanently delete stored records.
- Apply short retention periods and automatic expiration unless the user explicitly requests longer retention.
- Ensure stored memories cannot function as instructions and are treated only as untrusted contextual data.
- Add a clear rule that current user instructions override previously stored conversational summaries.
- Audit memory reads and writes so unauthorized or unexpected persistence can be detected.