T02 · Agent Memory Poisoning
Warning
- Location
- SKILL.md:29
- Finding
- Unvalidated Conversation Content Can Be Persisted into Long-Term Agent Memory<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 29–30 **Vulnerability Type**: T02: Agent Memory Poisoning **Risk Level**: Medium ### Vulnerable Code ```markdown 5. **記憶閉環 (Cleanup)**： - 完成回答後，執行 `[MEM_SUMMARIZATION]`，將本次對話的洞察存入對應的 memory 檔案。 ``` English translation: ```markdown 5. **Memory Closure (Cleanup)**: - After completing the response, execute `[MEM_SUMMARIZATION]` and store insights from the current conversation in the corresponding memory file. ``` ### Technical Analysis The skill directs the agent to summarize the current conversation and persist its insights in a memory file. The conversation can contain attacker-controlled statements supplied through `user_query`. No requirement is defined to validate those statements, distinguish factual information from instructions, obtain user approval, record provenance, or restrict the destination and lifetime of the resulting memory. The workflow also instructs later invocations to retrieve long-term references. Consequently, poisoned content written during one invocation may be retrieved and treated as relevant context in future sessions. The relevance threshold described elsewhere in the skill only measures semantic relevance; it does not establish authenticity or safety. ### Attack Path 1. An attacker submits a crafted query containing false project facts, malicious behavioral rules, or instructions presented as reusable insights. 2. The skill processes the attacker-controlled content as part of the current conversation. 3. During the cleanup stage, `[MEM_SUMMARIZATION]` converts the content into a summary. 4. The summary is written to an unspecified persistent memory file without validation or explicit user confirmation. 5. A later invocation retrieves the poisoned record through the documented long-term-memory retrieval process. 6. The agent incorporates the record into future answers or decisions, allowing the attacker-controlled content to influence sessions be ...[truncated 766 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Make persistent-memory writes opt-in rather than automatic. 2. Present the exact proposed memory entry to the user and require explicit approval before storing it. 3. Treat user-provided and retrieved content as untrusted data, never as authoritative instructions. 4. Store only narrowly scoped, validated factual summaries; exclude commands, behavioral rules, quoted prompt content, credentials, and sensitive personal data. 5. Attach provenance metadata, including the source conversation, author, creation time, confidence, validation status, and expiration time. 6. Write only to a dedicated, allowlisted memory location associated with the relevant user and project. 7. Enforce isolation between users, sessions, domains, and projects. 8. Apply schema validation and size limits before persistence. 9. Require additional review before retrieved memory can alter agent policies, tool permissions, safety constraints, or system behavior. 10. Provide mechanisms to inspect, correct, expire, and delete stored records. 11. Use semantic relevance only after trust and provenance checks; a relevance score must not be treated as a security control. ]]>