T02 · Agent Memory Poisoning
Error
- Location
- SKILL.md:16
- Finding
- Untrusted Memory Can Be Converted into Persistent Executable Agent Instructions## Vulnerability Details **File Location**: `SKILL.md`, lines 16-66 **Vulnerability Type**: Persistent agent memory poisoning **Risk Level**: High ### Vulnerable Code ```powershell # Read recent blocked items Get-Content memory/blocked-items.md | Select-String "Blocker" -Context 3 # Extract failure patterns Get-Content memory/tasks.md | Select-String "Status: failed" -Context 5 ``` ```markdown ### 3. Crystallize Write the lesson to a local skill: skills/local/{pattern_name}-recovery.md ``` ```markdown ### 4. Verify Next time a similar issue occurs: 1. Search `skills/local/` for matching skills 2. Execute recovery steps 3. Log result to `memory/{date}.md` 4. Update skill if needed ``` ### Technical Analysis The skill treats content from `memory/blocked-items.md` and `memory/tasks.md` as a source for reusable recovery instructions. It then directs the agent to write extracted lessons into `skills/local/`, execute those instructions during future matching situations, and update them based on subsequent results. The process does not define a trust boundary between historical task data and executable agent instructions. It also lacks provenance checks, an action allowlist, safety-policy revalidation, or mandatory user approval before a generated skill becomes active. The documented sensitive-data filter addresses selected privacy patterns but does not detect hostile instructions embedded in task or blocker records. Consequently, an attacker who can influence memory content could cause attacker-controlled text to be crystallized into a persistent local skill. The issue is persistence through the agent's own skill and memory mechanisms rather than an operating-system privilege escalation. ### Attack Path 1. An attacker, untrusted task, or compromised process causes malicious recovery guidance to appear in `memory/blocked-items.md` or `memory/tasks.md`. 2. Phoenix Loop reads the affected memory entry during diagnosis. 3. The malicious guidance is interpret ...[truncated 989 chars]
- Remediation
- ## Remediation Suggestions 1. Treat all task history, blocker records, logs, and memory files as untrusted data. 2. Do not directly convert free-form memory content into executable skill instructions. 3. Represent proposed recoveries using a strict schema with validated triggers and an allowlist of permitted actions. 4. Require explicit user review and approval before creating, enabling, updating, or executing a generated skill. 5. Reapply the agent's current safety and authorization policies to every generated recovery step. 6. Record the source and provenance of every proposed instruction in an immutable audit log. 7. Separate generated drafts from enabled skills; generated content should be inactive by default. 8. Reject instructions that request command execution, credential access, network access, configuration changes, or unrelated file operations unless separately authorized. 9. Add expiration and revocation controls for generated skills. 10. Test the mechanism against indirect prompt injection placed in task descriptions, error messages, blocker records, and tool output.