T02 · Agent Memory Poisoning
- Location
SKILL.md:49- Finding
Untrusted Session Content Can Be Promoted into Persistent Startup Memory
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 49-50 and 73-77
Vulnerability Type: Persistent memory poisoning
Risk Level: MediumVulnerable Code Snippet
markdown ### Layer 1: MEMORY.md (Central Index) - Navigation entry for all memories - Hard limit: 200 lines / 25KB - Must read on every startup - Contains: core info, status summary, system capabilities, key conclusions, promoted memoriesmarkdown ### 4. Short-to-Long Term Auto Promotion High-value memories (score > 0.8, appears 3+ times, affects trading decisions, user explicitly asked to remember) auto-promote from daily logs to MEMORY.md.Technical Analysis
The architecture automatically promotes information from daily logs into
MEMORY.md, which the agent must then read at every startup. The specification does not require provenance validation, instruction-versus-data separation, sanitization of embedded directives, or explicit user approval before promotion.Consequently, attacker-controlled conversational content can potentially be classified as a high-value memory and moved into a persistent startup context. Repetition is explicitly a promotion criterion, so an attacker may increase the likelihood of persistence by submitting the same malicious or misleading instruction at least three times. Once promoted, the content can influence future sessions independently of the original conversation.
The repository contains only the architecture document and no implementing scripts, so the vulnerability is present as an unsafe prescribed design rather than verified executable behavior.
Attack Path
- An attacker supplies a malicious instruction or falsified fact during one or more conversations.
- The content is recorded in a daily log or other short-term memory source.
- The attacker repeats the content three or more times, causes it to receive a score above
0.8, frames it as affecting a trading decisio ...[truncated 790 chars]
- Remediation
View remediation
Remediation Suggestions
- Treat all conversation-derived memories as untrusted data rather than executable instructions.
- Store memories in a typed schema that separates facts, preferences, summaries, and instructions.
- Reject or quarantine entries containing imperative directives, role changes, tool-use commands, safety-policy changes, or requests to override higher-priority instructions.
- Record provenance for every entry, including source conversation, author, timestamp, promotion reason, confidence, and validation status.
- Require explicit user confirmation before promoting any content capable of changing future agent behavior.
- Do not use repetition alone as a trust or promotion signal; repeated attacker input remains untrusted.
- Load persistent memory through a constrained parser and clearly delimit it as non-authoritative reference data.
- Add integrity checks, review logs, expiry policies, and a rollback mechanism for promoted memories.
- Prevent memory content from overriding system, developer, safety, or current-session instructions.