T02 · Agent Memory Poisoning
Error
- Location
- SKILL.md:359
- Finding
- Untrusted Conversation Content Can Poison Persistent Agent Instructions## Vulnerability Details **File Location**: `SKILL.md`, lines 359-380 and 454-461 **Vulnerability Type**: Persistent agent memory poisoning **Risk Level**: High ### Vulnerable Code ```markdown ### Promotion Rule (System Prompt Feedback) Promote recurring patterns into agent context/system prompt files when all are true: - `Recurrence-Count >= 3` - Seen across at least 2 distinct tasks - Occurred within a 30-day window Promotion targets: - `CLAUDE.md` - `AGENTS.md` - `.github/copilot-instructions.md` - `SOUL.md` / `TOOLS.md` for OpenClaw workspace-level guidance when applicable Write promoted rules as short prevention rules (what to do before/while coding), not long incident write-ups. ``` The promotion policy is reinforced by the following instruction: ```markdown 7. **Promote aggressively** - if in doubt, add to CLAUDE.md or .github/copilot-instructions.md ``` ### Technical Analysis The skill treats conversation-derived corrections, observations, and recurring patterns as inputs to a persistent learning workflow. Those inputs may eventually be promoted into files such as `CLAUDE.md`, `AGENTS.md`, `.github/copilot-instructions.md`, or `SOUL.md`, which can be automatically loaded as instructions in future agent sessions. The recurrence requirements establish frequency but do not establish trustworthiness. There is no requirement to: - Verify the identity or authority of the content source. - Distinguish trusted project-owner guidance from attacker-controlled prompts. - Review promoted content for conflicts with security policies. - Require explicit human approval before modifying instruction-bearing files. - Prevent promoted rules from authorizing tools, weakening validation, or overriding existing safeguards. - Preserve provenance in the final instruction file. The instruction to “promote aggressively” increases this risk by encouraging promotion when uncertainty remains. This creates a durable memory-poisoning channel rather than limiting learning ...[truncated 1373 chars]
- Remediation
- ## Remediation Suggestions 1. Keep `.learnings/` records informational and non-authoritative by default. 2. Require explicit project-owner approval before writing conversation-derived content into any automatically loaded instruction file. 3. Remove the “promote aggressively” policy and replace it with a conservative review requirement. 4. Record immutable provenance for every candidate, including source session, author or trust level, creation time, and approving reviewer. 5. Permit automatic promotion only from authenticated, explicitly trusted sources. 6. Add semantic validation that rejects rules which: - Weaken higher-priority safety or security controls. - Authorize new tools, network destinations, or credentials. - Request secret collection or reduced redaction. - Modify approval boundaries. - Instruct agents to ignore existing policies. 7. Store proposed promotions in a review queue or patch file instead of directly editing instruction-bearing files. 8. Require signed or reviewed changes to persistent agent configuration. 9. Ensure learned content can never override system, organization, or repository-owner policies. 10. Provide a rollback mechanism and an audit log for all promotions.