T02 · Agent Memory Poisoning
Warning
- Location
- SKILL.md:27
- Finding
- Automatic Persistent Storage of User-Controlled Analysis and Feedback<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 27–92 **Vulnerability Type**: Persistent memory poisoning and sensitive-data retention **Risk Level**: Medium ### Complete Relevant Snippet The following is an English translation of the relevant instructions: ```text The skill has the ability to evolve continuously. After each analysis, the system automatically records the analysis process and results for subsequent optimization. When the user uses the skill for an in-depth analysis: 1. Analysis record - Problem type, models used, and core insights - Record in: memory/chunfeng-analysis-log.md 2. Effectiveness feedback - User evaluation of analysis quality through conversation feedback - Record effective aspects and areas for improvement 3. Periodic review - Conduct a self-review after every 10 analyses - Identify recurring patterns - Summarize effective methodologies 4. Version update - Update content based on accumulated insights - Update the version number and iteration record - Notify the user about updated content Storage locations: - Analysis log: memory/chunfeng-analysis-log.md - User feedback: memory/chunfeng-feedback.md - Iteration record: the "Version History" section of this document ``` ### Technical Analysis The Skill instructs the Agent to automatically persist the analysis process, results, core insights, and user feedback. The stored information is then consumed during periodic reviews and may be used to update the Skill's methodology and content. Because problem descriptions and feedback are controlled by users, this creates a persistent untrusted-input channel. The instructions do not require: - Explicit user consent before storage. - Redaction of credentials, personal data, or confidential business information. - Separation of data belonging to different users or sessions. - Validation or neutralization of instruction-like content. - Retention limits or a deletion mechanism. - Hum ...[truncated 2841 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Make persistence explicitly opt-in** - Ask for informed user consent before retaining any analysis or feedback. - Keep logging disabled by default. - Clearly identify what will be stored, why it is needed, and for how long. 2. **Minimize and sanitize stored data** - Store abstract, non-identifying lessons rather than complete prompts or analysis results. - Detect and redact credentials, access tokens, personal identifiers, financial data, health information, and confidential business material. - Reject or encode instruction-like content so that it remains inert data. 3. **Establish a trust boundary** - Mark all memory records as untrusted user-derived content. - Prohibit memory entries from overriding system, developer, safety, or Skill instructions. - Require evidence from multiple independent records before identifying a recurring pattern. 4. **Isolate memory** - Use separate storage for each user and session. - Prevent one user's records from affecting another user's output. - Apply least-privilege access controls to memory and Skill files. 5. **Control self-modification** - Do not automatically update Skill instructions from stored feedback. - Generate proposed changes as a reviewable diff. - Require explicit human approval before modifying methodology, version history, or Skill content. - Maintain signed or immutable trusted baseline files and support rollback. 6. **Add lifecycle controls** - Define a short retention period. - Provide inspection, correction, export, and deletion mechanisms. - Record provenance and timestamps for every retained item. - Delete records when consent is withdrawn or their purpose expires. 7. **Harden periodic review** - Perform reviews in a non-instructional parsing context. - Summarize data through a schema that excludes executable directives. - Log which records contributed to each proposed update. - Test review ...[truncated 50 chars]