T02 · Agent Memory Poisoning
Warning
- Location
- SKILL.md:27
- Finding
- Automatic Persistent Memory Writes Enable Cross-Session Memory Poisoning## Vulnerability Details **File Location**: `SKILL.md`, lines 27-42 and 68-72 **Vulnerability Type**: Persistent memory poisoning through silent, automatic state updates **Risk Level**: Medium ### Vulnerable Instructions ```markdown ### Phase 1: Silent Background Operations **Trigger**: Continuous during active sessions. - **00:00 Daily Boot**: - On the first prompt of a new day, verify the existence of `memory/YYYY-MM-DD.md`. Create it with a standard template if missing. - **30-Minute Checkpoint**: - *Action*: Every 30 minutes of active interaction, briefly summarize the immediate context (What are we building? What bugs are we fixing?). - *Storage*: Append this snapshot seamlessly under the current time block in today's Episodic Memory file. - **Insight Extraction**: - *Action*: If a significant decision is made, a rule is established by the user, or a major task completes, extract the "Core Knowledge" and append it to the long-term `memory/MEMORY.md`. ``` ```markdown 3. **Immutability of the Past**: When writing to `YYYY-MM-DD.md`, **only append** to the end of the file. Do not rewrite historical entries from earlier in the day unless explicitly fixing a critical factual error directed by the user. ``` ### Technical Analysis The Skill instructs the agent to create and update persistent memory continuously and silently. Conversation content classified as a user rule, important decision, task result, or contextual snapshot is written to daily memory files or the long-term `memory/MEMORY.md` file without requiring explicit confirmation for each write. This creates a persistent indirect-instruction channel. Untrusted content introduced through user messages, copied documents, web content, issue descriptions, or other retrieved material can be misclassified as authoritative core knowledge. Once stored, later memory retrieval can cause the content to influence future sessions even after the original untruste ...[truncated 2649 chars]
- Remediation
- ## Remediation Suggestions 1. Require explicit opt-in before enabling persistent memory and clear confirmation before writing any long-term rule, preference, credential-related context, or sensitive fact. 2. Distinguish direct user statements from quoted, generated, retrieved, or third-party content. Never promote instructions from untrusted content into semantic memory automatically. 3. Store provenance with every entry, including timestamp, source type, originating session, confidence, and whether the user explicitly approved it. 4. Treat all retrieved memory as untrusted reference data. Require current-session validation before allowing a stored entry to direct tool use or override current instructions. 5. Add schema validation and an allowlist of permitted memory categories. Reject executable instructions, requests to bypass safety rules, secrets, authentication material, and unrelated operational commands. 6. Implement sensitive-data detection and redaction before writing memory. Define retention periods and provide review, export, correction, and deletion controls. 7. Replace unconditional append-only behavior with auditable correction and revocation records. Ensure searches suppress entries marked invalid or superseded. 8. Restrict memory writes to a dedicated approved directory using least-privilege file permissions and prevent stored content from selecting arbitrary paths. 9. Present proposed semantic-memory changes to the user as a reviewable diff before committing them. 10. Add tests covering prompt injection through quoted text, retrieved documents, conflicting rules, sensitive information, and poisoned-memory recall.