T02 · Agent Memory Poisoning
Error
- Location
- SKILL.md:72
- Finding
- Untrusted Conversation Content Is Persisted and Reintroduced Across Sessions## Vulnerability Details **File Location**: `SKILL.md`, lines 72-109 **Vulnerability Type**: Persistent memory poisoning **Risk Level**: High ### Evidence The relevant documentation instructs the agent to scan every message and persist broad categories of user-controlled content: ```text WAL trigger scan (required for every message) Preference → mem0 add Experience → mem0 add Important fact → mem0 add Correction → SESSION-STATE Decision → SESSION-STATE + mem0 Number/date → SESSION-STATE URL/path → SESSION-STATE Proper noun → Store after evaluation Priority: SESSION-STATE over mem0 ``` It then defines the following persistence and recovery workflow: ```text When receiving a message: Scan type ├─ [preference/experience/fact] → mem0 add ├─ [correction/decision/number/URL] → SESSION-STATE.md └─ [casual conversation/no value] → do not store Reply to the user After replying: Is context utilization above 60 percent? └─ Yes → activate WORKING-BUFFER.md Truncation recovery in the next session: 1. mem0 get_all → restore long-term semantic memory 2. mem0 chat → proactively ask whether to continue the previous task 3. SESSION-STATE.md → restore current task state 4. WORKING-BUFFER.md → restore conversation from the high-context area ``` ### Technical Analysis The Skill requires automatic processing of every message and directs the agent to store user-controlled facts, corrections, decisions, URLs, file paths, dates, and other data in long-term or session state. The stored information is subsequently restored in future sessions and used by the memory-assisted chat workflow. No trust boundary is defined between remembered data and agent instructions. There are no requirements to reject instruction-like content, credentials, tokens, malicious URLs, prompt-injection payloads, or other sensitive values before persistenc ...[truncated 1851 chars]
- Remediation
- ## Remediation Suggestions 1. Replace mandatory automatic storage with explicit, informed user consent for each memory category. 2. Treat all retrieved memories as untrusted data and place them in a clearly delimited user-data section, never in a privileged system-instruction section. 3. Reject or quarantine memories containing imperative instructions, role changes, tool commands, encoded payloads, prompt-control language, or requests to override policy. 4. Do not retain credentials, API keys, authentication tokens, local paths, private URLs, personal identifiers, or other secrets. 5. Add provenance metadata recording the source user, session, creation time, confidence, and validation status of every memory. 6. Enforce strict isolation among users, sessions, and agents. Shared Agent Memory should require an explicit allowlist and authorization check. 7. Apply retention periods, storage quotas, encryption at rest, access controls, audit logging, and reliable deletion. 8. Require user confirmation before restoring old task state or using remembered data to perform tool actions. 9. Sanitize and validate state files before loading them, and provide a safe interface for users to review, edit, and delete retained data.