T02 · Agent Memory Poisoning
Error
- Location
- SKILL.md:60
- Finding
- Persistent Modification of Agent Instructions and Long-Term Memory<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 60-72 **Vulnerability Type**: Persistent agent instruction and memory manipulation **Risk Level**: High ### Vulnerable Code Snippet ```markdown ## 3) Anti-Stall Contract Write or update `AGENTS.md` with these mandatory constraints: - Output state on each substantial task: `Goal`, `Progress`, `Next`. - Do not stop before completion except for explicit blocker or user stop. - On failure: retry, then fallback, then report minimal unblock input. - Multi-step completion must include evidence artifact path or command result summary. Write or update `HEARTBEAT.md`: - Each cycle performs at most 1-2 checks. - Either produce execution evidence or exactly `HEARTBEAT_OK`. - If queue item exists, execute one concrete step, then log evidence to `memory/YYYY-MM-DD.md`. ``` ### Technical Analysis The Skill instructs the agent to write mandatory behavioral constraints into `AGENTS.md` and `HEARTBEAT.md`, which are persistent agent-control files rather than temporary task output. These changes alter how future agent sessions behave after the original setup operation has ended. The instruction to continue until completion, retry failures, execute queued work during heartbeat cycles, and record results in persistent memory establishes an ongoing behavioral policy. It does not require the user to review or approve the exact resulting contents before they are installed. Existing safety, stopping, or approval rules could also be weakened if these files are overwritten rather than safely merged. ### Attack Path 1. A user invokes the Skill for an OpenClaw setup or troubleshooting task. 2. The agent follows the Skill and writes the supplied mandatory constraints into `AGENTS.md` and `HEARTBEAT.md`. 3. Those files remain present after the initiating session ends. 4. A later session or heartbeat cycle loads the persistent instructions. 5. The agent continues queued work, retries operations, and writes executi ...[truncated 763 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Do not automatically write Skill-provided rules into persistent instruction or memory-control files. - Display a complete proposed diff and require explicit user approval before modifying `AGENTS.md` or `HEARTBEAT.md`. - Preserve existing safety, authorization, and stopping rules; never replace them with less restrictive directives. - Scope anti-stall behavior to the current session unless the user explicitly requests persistence. - Require fresh authorization before executing an item discovered in a queue or memory file. - Treat queue and memory contents as untrusted data rather than executable instructions. - Back up every modified file and document an exact rollback process for all persistent instruction changes. ]]>