T02 · Agent Memory Poisoning
Error
- Location
references/hook-template/handler.ts:50- Finding
Persistent Agent Context Poisoning Through Untrusted Preview Content
- Content
View full analysis
{ const m = content.match(regex); return m ? m[1].trim().replace(/^[\s-]+/gm, "") : "（无）"; }; const summary = extract(/##\s*本次 session 摘要[\r\n]+([\s\S]*?)(?=##\s*未完成|##\s*醒来|##\s*关键)/i); const items = extract(/##\s*未完成事项[\r\n]+([\s\S]*?)(?=##\s*醒来|##\s*关键)/i); const nextStep = extract(/##\s*醒来后第一步[\r\n]+([\s\S]*?)(?=##\s*关键)/i); const context = extract(/##\s*关键上下文[\r\n]+([\s\S]*?)(?=##\s*状态|$)/i); const recoveryText = [ "🌙 检测到上次 session 有未完成事项，恢复上下文：", "", `**上次 session 摘要**：${summary}`, "", `**未完成事项**：\n${items}`, "", `**醒来后第一步**：${nextStep}`, "", `**关键上下文**：${context}`, "", "请根据上述信息，继续处理未完成的事项。", ].join("\n"); log(`[hook] Recovery text length: ${recoveryText.length} chars`); // 注入到 bootstrapFiles if (event.context && Array.isArray(event.context.bootstrapFiles)) { event.context.bootstrapFiles.unshift({ path: `memory:session-recovery/${sessionKey}.md`, content: recoveryText, isInline: true, }); log(`[hook] Injected via bootstrapFiles (count=${event.context.bootstrapFiles.length})`); } else { log(`[hook] bootstrapFiles not available, context keys: ${JSON.stringify(Object.keys(event.context || {}))}`); } ``` ### Technical Analysis The hook treats the preview file as trusted recovery information and inserts its contents directly into `event.context.boo ...[truncated 1964 chars]- Remediation
View remediation