T02 · Agent Memory Poisoning
Error
- Location
- SKILL.md:72
- Finding
- Untrusted Learning Content Can Be Promoted into Persistent Agent Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:72`, `SKILL.md:138`, `SKILL.md:182` **Vulnerability Type**: Persistent memory poisoning through unvalidated promotion **Risk Level**: High ### Vulnerable Code Snippets `SKILL.md:72` permits learning records to originate from conversations and user feedback: ```markdown **Source**: conversation | error | user_feedback | self_discovery ``` `SKILL.md:138` explicitly permits promoted records to be written into an authoritative Agent instruction file: ```markdown | **promoted** | 已提升到更高层 | 如写入 AGENTS.md | ``` `SKILL.md:182` directs later sessions to load the affected persistent files: ```powershell Read SOUL.md, AGENTS.md, MEMORY.md ``` ### Technical Analysis The Skill establishes a workflow in which content derived from conversations or user feedback can be stored as a learning record and subsequently promoted into `AGENTS.md`. It also instructs the Agent to read `AGENTS.md` during future session startup. The documented workflow does not define a trust boundary between untrusted conversational content and authoritative persistent instructions. It provides no mandatory trusted-user approval, provenance enforcement, instruction filtering, schema validation, or separation between descriptive knowledge and executable Agent directives. An attacker can therefore submit content framed as feedback or a reusable lesson that includes instructions intended to alter future Agent behavior. If that content passes through the documented promotion workflow into `AGENTS.md`, it can influence subsequent sessions whenever the file is loaded. The risk is persistent rather than limited to the session in which the content was supplied. The audit found no evidence that promotion is automatically performed by executable code in this package. Exploitation depends on an Agent or operator following the documented workflow and promoting attacker-controlled content. ### Attack Path 1. An attacker provides crafted con ...[truncated 1302 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Prohibit direct promotion of raw conversation, error, or user-feedback content into `AGENTS.md`, `SOUL.md`, or equivalent authoritative instruction files. 2. Store descriptive knowledge separately from executable Agent instructions. Treat `.learnings` content as untrusted data when it is read. 3. Require explicit approval from an authenticated, trusted operator before modifying persistent instruction files. 4. Preserve provenance for every promoted record, including its original source, author, timestamp, content hash, reviewer, and approval decision. 5. Restrict promoted records to a predefined schema that contains factual summaries rather than free-form instructions. 6. Detect and reject imperative language, tool directives, role changes, requests to ignore prior instructions, encoded payloads, and attempts to modify security constraints. 7. Present an exact diff before promotion and require confirmation for every destination file. 8. Keep versioned backups and an append-only audit log so unauthorized changes can be identified and rolled back. 9. Apply least-privilege filesystem controls so routine learning operations cannot write to authoritative Agent configuration files. 10. Add adversarial tests demonstrating that malicious user feedback cannot become a persistent instruction. ]]>