T02 · Agent Memory Poisoning
Warning
- Location
- v3-original.md:208
- Finding
- Unscoped Persistence of Generated Investment Reports in Agent Memory## Vulnerability Details **File Location**: `v3-original.md`, lines 208–212 **Vulnerability Type**: Persistent agent-state contamination **Risk Level**: Medium ### Vulnerable Instruction ```markdown ## Execution Discipline - Save progress every 30 minutes - If blocked, skip the blocked item and continue - Store the final output in the memory directory ``` The snippet above is an English rendering of the original instruction at the cited location. ### Technical Analysis The skill directs the agent to save intermediate progress periodically and place its final output in the agent's persistent `memory` directory. Persisting an investment report is not necessary to perform the skill's declared analytical function. The instruction does not define a filename, storage namespace, retention period, content-validation process, or requirement for user consent. Because the report is generated from user-supplied investment context, inaccurate or manipulated content may be written into persistent state. If later sessions consume that state, stale or attacker-influenced financial conclusions could affect future responses. The primary `SKILL.md` does not disclose this persistence behavior, making it unexpected relative to the skill's stated workflow. This is categorized as agent memory poisoning because untrusted, generated content is directed into long-term agent storage. The instruction does not explicitly write new behavioral rules, so the demonstrated impact is limited to persistent state contamination rather than confirmed control of future agent instructions. ### Attack Path 1. A user invokes the V3 investment-analysis workflow. 2. The user supplies stock information, assumptions, or other context that influences the generated report. 3. The skill instructs the agent to save progress and store the final report in the persistent memory directory. 4. The generated, user-influenced content remains available across sessions. ...[truncated 720 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the instruction to store final output in the agent's memory directory. 2. Return reports directly to the user by default rather than persisting them. 3. If file persistence is requested, require explicit user confirmation and use a user-approved, task-scoped destination. 4. Generate a unique, sanitized filename within a dedicated namespace to prevent collisions or path manipulation. 5. Apply content validation and prevent generated reports from being interpreted as agent instructions. 6. Define retention and deletion policies for saved reports. 7. Avoid periodic background saves unless the runtime provides a narrowly scoped, user-visible workspace. 8. Document all persistence behavior in `SKILL.md`, including what is stored, where it is stored, and how users can delete it.