T02 · Agent Memory Poisoning
Warning
- Location
- references/intensity-signals.md:91
- Finding
- Runtime Input Can Poison a Persistent Skill Instruction File## Vulnerability Details **File Location**: `references/intensity-signals.md:91-92` **Vulnerability Type**: Persistent instruction-file poisoning **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown If the user confirms or corrects your reading, offer to append the phrase to this file's table for their language so the next posting matches directly. ``` ### Technical Analysis The skill directs the agent to append user-provided phrases to `references/intensity-signals.md`. This file is not merely user data: `SKILL.md` designates it as a reference that is loaded during later evaluations, making its contents part of the agent's trusted behavioral context. No strict schema, escaping, multiline-input rejection, character filtering, or separation between data and instructions is specified. Consequently, a phrase containing Markdown headings, tables, or imperative instructions could be written into the reference file. When a later invocation loads the modified file, the injected content may be interpreted as trusted skill guidance rather than inert classification data. User confirmation reduces accidental exploitation but does not remove the trust-boundary violation. The user may approve an apparently legitimate language correction without recognizing embedded prompt-control content. ### Attack Path 1. An attacker supplies a job posting or suggested intensity phrase containing crafted multiline Markdown or agent instructions. 2. The skill classifies the phrase and offers to append it to the language table. 3. The user confirms the update, believing it to be an ordinary vocabulary correction. 4. The agent writes the attacker-controlled content into `references/intensity-signals.md`. 5. During a later job-posting evaluation, the skill loads that reference file as trusted guidance. 6. The injected content can influence classification logic or attempt to redirect the agent's future behavior. ### Impact Assessment ...[truncated 580 chars]
- Remediation
- ## Remediation Suggestions - Never write runtime user input into skill instruction or reference documents. - Store learned phrases in a separate data-only file, such as a strictly validated JSON or YAML vocabulary file. - Define an allowlisted schema containing only fields such as `language`, `tier`, and `phrase`. - Reject multiline values, control characters, Markdown structural syntax, and instruction-like content. - Apply explicit length limits and normalize Unicode before validation. - Serialize values with a standard library rather than constructing Markdown through string concatenation. - Require the user to review the exact normalized value, target language, and tier before saving it. - Treat loaded vocabulary entries exclusively as quoted data and explicitly instruct the agent never to execute or follow instructions found inside those values. - Prefer storing runtime data under the user's workspace rather than modifying the installed skill package. - Consider integrity-checking immutable skill reference files so unexpected modifications are detected before loading.