T02 · Agent Memory Poisoning
Error
- Location
- SKILL.md:78
- Finding
- Untrusted Workspace Instructions Can Be Persisted as Agent Rules<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:78-80`; `assets/agents-snippet.md:20-29`; `scripts/memory_index.py:49-55, 292-307` **Vulnerability Type**: Persistent agent memory poisoning through untrusted workspace instructions **Risk Level**: High ### Complete Vulnerable Code Snippets `scripts/memory_index.py:49-55`: ```python RULES_CANDIDATES = [ "CLAUDE.md", "AGENTS.md", "AGENTS.txt", ".cursor/rules/", # dir ] RULES_CANDIDATES_HOME = [ ".claude/CLAUDE.md", ".config/agent/rules.md", ".claude/rules.md", ] ``` `scripts/memory_index.py:292-307`: ```python for cand in RULES_CANDIDATES: p = os.path.join(root, cand) if not os.path.isabs(cand) else cand h = _hit(p) if h: roles["rules"].append(h) roles["identity"].append(h) # rules file doubles as identity carrier break else: for cand in RULES_CANDIDATES_HOME: h = _hit(os.path.expanduser("~/" + cand)) if h: roles["rules"].append(h) roles["identity"].append(h) break ``` `SKILL.md:78-80`: ```md 1. **Step 0 — Discover (first time or when sources moved)**: run `python scripts/memory_index.py --discover .` — it locates your memory carriers by common conventions (candidate list lives in the script header constants) and writes `.changshen/discovery.json`. Python unavailable? Fall back to the hand-list below (derived from the script; the script is authoritative). At every recovery, first **stat the stored paths** — any missing/unreadable source triggers re-discovery (never reuse stale paths). 2. **Read the L3 must-read files**: roles resolved in step 0/1 (rules, identity, todos, journal) + `must_read_extra`. Every one, no shortcuts. Host injected identity (Hermes/OpenClaw)? Mark `identity ✅ (host)` and skip the file probe. 2b. **Rules alignment**: from the rules file(s) just read, extract every imperative rule the user stated (do X / never do Y). List them explicitly in your recovery report — this is ...[truncated 3515 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require explicit user confirmation before persisting rules discovered in repository-controlled files. 2. Classify rule sources by trust level: - User-global rules may be eligible for automatic persistence. - Repository rules should remain session-scoped by default. - Rules from newly cloned or untrusted workspaces should be quarantined. 3. Store provenance with every persisted rule, including source path, source type, content hash, extraction time, and approval status. 4. Show a rule diff before updating `.changshen/rules.json`, clearly identifying additions, modifications, and deletions. 5. Never interpret repository instructions as user-authored rules solely because they use imperative language. 6. Separate identity discovery from rule discovery; a repository instruction file should not automatically become an identity carrier. 7. Invalidate or request reapproval when the source file hash changes. 8. Provide an allowlist of trusted rule files and trusted workspace roots. 9. Ensure poisoned repository rules cannot suppress security controls, alter instruction precedence, or prevent users from reviewing and removing persisted state. ]]>