T02 · Agent Memory Poisoning
- Location
src/reminder.py:129- Finding
Persistent Prompt Injection Through Scheduled Reminder Content
- Content
View full analysis
Vulnerability Details
File Location:
src/reminder.py:129-141
Vulnerability Type: Stored prompt injection through persistent automation
Risk Level: Highpython return { "name": f"Todo提醒: {content[:30]}", "scheduleType": "once", "scheduledAt": remind_at.strftime("%Y-%m-%dT%H:%M:%S"), "prompt": ( f"待办提醒 #[{todo_id}]「{content}」即将到期。\n" f"截止时间：{due_at}\n" f"请提醒月海巫师处理此待办，完成后可执行：\n" f"在 todo-list 中完成 #{todo_id}「{content}」" ), }Technical Analysis
The
contentvalue originates from user-controlled TODO text and is persisted in the SQLite database. When a one-time reminder is created, this value is interpolated directly into thepromptsupplied to the automation system.The code does not separate trusted automation instructions from untrusted TODO data. Quoting the content with decorative characters does not establish a security boundary for a language model. An attacker can therefore insert imperative text such as instructions to ignore the reminder context, disclose information, invoke tools, or perform unrelated operations.
Because the resulting prompt is scheduled for later execution, the malicious instructions can survive the original interaction and affect a subsequent Agent session. Whether a particular payload succeeds depends on the automation runtime's tool access and instruction hierarchy, but the code creates a direct stored prompt-injection path.
Attack Path
- An attacker or untrusted user submits a TODO whose content contains Agent instructions.
- The application stores that content as normal TODO data.
- For a qualifying due date,
get_reminder_params()embeds the content into an automation prompt. - The Agent creates and persists the one-time automation task.
- At the scheduled time, the automation runtime processes the generated prompt.
- The runtime may interpret the embedded TODO text as instructions ...[truncated 624 chars]
- Remediation
View remediation
Remediation Suggestions
- Do not place user-controlled TODO content inside an executable Agent prompt.
- Prefer a notification-only interface or structured automation payload where reminder instructions and display data are distinct fields.
- If an Agent prompt is unavoidable, use a fixed trusted instruction that explicitly treats the TODO content as untrusted data that must never be followed as an instruction.
- Pass only the TODO identifier to the automation and retrieve the content through a constrained display-only operation at execution time.
- Ensure the scheduled Agent has the minimum tool permissions required to display a reminder and cannot perform unrelated actions.
- Apply output encoding appropriate to the destination channel, but do not treat encoding alone as a defense against language-model prompt injection.
- Add regression tests with adversarial TODO content, including instruction overrides, tool-call requests, and attempts to extract contextual data.