T02 · Agent Memory Poisoning
Error
- Location
skills/context-optimizer/optimize.js:215- Finding
Untrusted Conversation Content Is Persisted into Long-Term Agent Memory
- Content
View full analysis
{ let match; while ((match = pattern.exec(content)) !== null) { facts.push(match[0].trim()); } }); return facts; } ``` ```js updateMemory(summary) { // Use configured memory file const memoryFile = path.join(this.workspaceDir, this.config.storage.memory_file); let memoryContent = ''; if (fs.existsSync(memoryFile)) { memoryContent = fs.readFileSync(memoryFile, 'utf8'); } // Append new facts to memory const newMemoryContent = summary.factsToRemember .filter(fact => !memoryContent.includes(fact)) .map(fact => `- ${fact}`) .join('\n'); if (newMemoryContent && this.config.summarization.include_facts) { const timestamp = new Date().toISOString(); const updatedContent = memoryContent + `\n\n## Context Optimization - ${timestamp}\n${newMemoryContent}\n`; fs.writeFileSync(memoryFile, updatedContent); console.log(`Updated ${this.config.storage.memory_file} with ${summary.factsToRemember.length} new facts`); } } ``` ### Technical Analysis The optimizer treats text from user and assistant messages as trusted facts. Broad regular expressions extract matching text and pass it directly into `MEMORY.md` without validating its source, semantic meaning, ...[truncated 1861 chars]- Remediation
View remediation