T02 · Agent Memory Poisoning
- Location
SKILL.md:38- Finding
Automatic Persistent Storage of Untrusted Personal Context
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 38–51
Vulnerability Type: Agent Memory Poisoning and Excessive Personal Data Retention
Risk Level: MediumVulnerable Code
markdown ## Auto-Save During Conversation Detect and save without being asked when the user shares: | Signal | Section | File | |---|---|---| | Name, job, company, location, family | `## Facts` | `MEMORY.md` | | "I prefer…", "I hate…", "always use…" | `## Preferences` | `MEMORY.md` | | "I decided to…", "let's go with…", deadlines | `## Action Items` | `MEMORY.md` | | Project names, key people, recurring context | daily log | `memory/YYYY-MM-DD.md` | | Patterns you've noticed about the user | `## Learned` | `MEMORY.md` | After auto-saving, confirm briefly in one line: "Noted: [distilled fact]."Related automatic loading behavior is defined at
SKILL.md, lines 29–31:markdown ## On Session Start OpenClaw auto-loads `MEMORY.md` plus today's and yesterday's daily files. Use this loaded context immediately — no tool call needed. Scan for open Action Items and surface any that are overdue or relevant to the user's first message.Technical Analysis
The Skill instructs the Agent to persist names, employment information, locations, family details, preferences, project context, and inferred behavioral patterns without obtaining prior consent. The confirmation occurs only after the write.
The persistence logic does not require provenance validation or distinguish direct user assertions from quoted text, externally retrieved material, role-play, forwarded messages, or other attacker-controlled content. Consequently, false facts, preferences, action items, or inferred rules can enter long-term state. Because the Skill instructs OpenClaw to load and immediately use this state in subsequent sessions, poisoned entries may continue influencing the Agent after the original conversation ends.
The sensitive-da ...[truncated 1627 chars]
- Remediation
View remediation
Remediation Suggestions
- Require explicit opt-in before every persistent write. Display the exact proposed entry, destination file, section, and retention period before saving it.
- Treat post-write notification as insufficient; perform the write only after affirmative user confirmation.
- Save only direct user assertions. Do not persist information derived from quoted messages, retrieved documents, tool output, third-party content, role-play, or prompt examples.
- Disable inferred
## Learnedentries by default. If enabled, label them as unverified inferences and require explicit approval. - Record provenance metadata for each entry, including creation time, originating conversation, whether it was directly asserted or inferred, and its verification status.
- Apply expiration periods to daily context, inferred patterns, and action items unless the user explicitly requests indefinite retention.
- Validate loaded memory as untrusted data rather than executable instructions. Stored entries must not override system policies, safety requirements, or current-session user intent.
- Provide simple commands to inspect, correct, export, and permanently delete retained information.
- Preserve the existing sensitive-data denylist and expand it to cover additional personal data categories according to the deployment's privacy requirements.
- Resolve contradictory entries through explicit user confirmation before using or replacing prior memory.