T02 · Agent Memory Poisoning
Error
- Location
scripts/cleanup.sh:139- Finding
Untrusted research content is persisted into long-term agent memory
- Content
View full analysis
/dev/null || echo "") ``` ```bash { # Add newline if MEMORY.md doesn't end with one if [ -s "${MEMORY_PATH}" ]; then last_char=$(tail -c1 "${MEMORY_PATH}" | xxd -p 2>/dev/null || echo "") [ "${last_char}" != "0a" ] && echo "" fi echo "${ENTRY}" } >> "${MEMORY_PATH}" ``` The related Skill instructions also direct the agent to append research results to `.learnings/research-log.md` and modify `SKILL.md` when research identifies perceived methodology problems. ### Technical Analysis Research claim content can originate from user-controlled input or untrusted external sources. Claim previews are loaded from `manifest.json`, selected as core conclusions, inserted into `ENTRY`, and appended to `/root/.openclaw/workspace/MEMORY.md`. The implementation performs no trust-boundary validation, instruction neutralization, provenance enforcement, or human approval before placing this content in persistent agent memory. Markdown or natural-language instructions embedded in a source can therefore be stored alongside trusted long-term context. The Skill's self-improvement guidance compounds this risk by encouraging durable changes to the Skill instructions based on research-derived material. Although the shell script does not itself edit `SKILL.md`, the instruction can cause the executing agent to do so. ### Attack Path 1. An attacker supplies a research sourc ...[truncated 1246 chars]- Remediation
View remediation