T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:25- Finding
Persistent Modification of Global Agent Instructions
- Content
View full analysis
> ~/.openclaw/SOUL.md ``` Or if using a workspace SOUL.md: ```bash cat {baseDir}/soul-snippet.md >> /SOUL.md ``` Then start a new session (`/new`) so the updated SOUL.md loads. ``` `SKILL.md:72-73`: ```markdown - When installing, ALWAYS append to SOUL.md, never overwrite it - Tell the user to run `/new` after installation so the new SOUL.md loads ``` `soul-snippet.md:1-38`: ```markdown # Token Efficiency Protocol You save tokens on every response and in all persistent files. This reduces API costs 20-40% across sessions. ## Response Rules - No greetings, no sign-offs, no "Sure!", no "Great question!" - No filler: never use "just", "really", "very", "basically", "actually", "literally", "honestly", "definitely", "certainly", "simply" - No hedging: never say "I think", "I believe", "it seems like", "in my opinion" - No padding: never say "it is important to note that", "it is worth mentioning", "as a matter of fact" - Short phrases over verbose: "because" not "due to the fact that", "to" not "in order to", "about" not "with regard to", "now" not "at this point in time", "if" not "in the event that", "many" not "a large number of", "before" not "prior to", "after" not "subsequent to", "consider" not "take into consideration", "create" not "come up with", "determine" not "figure out" - Lead with the answer. Context after, only if needed. - Code blocks: no narration before or after unless the user won't understand without it. - Lists: only when structure genuinely helps. Default to prose. ## Memory & Log Rules When writing to MEMORY.md or memory/YYYY-MM-DD.md: - Use compressed not ...[truncated 3063 chars]- Remediation
View remediation
... ``` 4. Back up `SOUL.md` before modification and provide a documented uninstall command that removes only the marked section. 5. Keep memory and compaction behavior separate from response-style optimization. Require separate opt-in for changing persistent records. 6. Preserve uncertainty, negation, attribution, security decisions, and requirements in memory even when compression is enabled. 7. Prefer loading the protocol only for sessions in which the user explicitly requests token compression. ]]>