T02 · Agent Memory Poisoning
- Location
SKILL.md:128- Finding
Untrusted Conversation Content Can Poison Persistent Agent Memory
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 16, 128–155, 211–217, 260–267, and 305
Vulnerability Type: Persistent agent memory poisoning
Risk Level: HighVulnerable Code Snippets
markdown | Broadly applicable learning | Promote to `CLAUDE.md` and/or `AGENTS.md` |markdown ## Promoting to Project Memory When a learning is broadly applicable (not a one-off fix), promote it to permanent project memory. ### When to Promote - Learning applies across multiple files/features - Knowledge any contributor (human or AI) should know - Prevents recurring mistakes - Documents project-specific conventions ### Promotion Targets | Target | What Belongs There | |--------|-------------------| | `CLAUDE.md` | Project facts, conventions, gotchas for all Claude interactions | | `AGENTS.md` | Agent-specific workflows, tool usage patterns, automation rules | ### How to Promote 1. **Distill** the learning into a concise rule or fact 2. **Add** to appropriate section in target file 3. **Update** original entry: - Change `**Status**: pending` → `**Status**: promoted` - Add `**Promoted**: CLAUDE.md` or `**Promoted**: AGENTS.md`markdown ## Detection Triggers Automatically log when you notice: **Corrections** (→ learning with `correction` category): - "No, that's not right..." - "Actually, it should be..." - "You're wrong about..." - "That's outdated..."markdown 7. **Promote aggressively** - if in doubt, add to CLAUDE.mdTechnical Analysis
The skill treats conversation-derived corrections, knowledge claims, and operational guidance as candidate learning material. It then instructs the agent to promote sufficiently broad material into
CLAUDE.mdorAGENTS.md, which are persistent instruction files commonly consumed by future agent sessions.No trust-boundary validation, provenance enforcement, content sanitization, instru ...[truncated 2307 chars]
- Remediation
View remediation
Remediation Suggestions
-
Prohibit automatic promotion
- Do not automatically write conversation-derived content to
CLAUDE.md,AGENTS.md, or other persistent instruction files. - Replace “promote aggressively” with a deny-by-default policy.
- Do not automatically write conversation-derived content to
-
Require explicit human approval
- Present the exact proposed entry and destination file to an authorized user.
- Require explicit confirmation before modifying persistent memory.
- Record who approved the change and when.
-
Separate observations from trusted instructions
- Store unverified learnings in a non-executable review queue.
- Clearly label their source, trust level, and verification status.
- Prevent future agents from treating pending observations as authoritative instructions.
-
Apply strict content validation
- Permit only declarative, project-specific facts through a constrained schema.
- Reject shell commands, executable workflows, credential requests, external URLs, encoded content, and instructions that alter security controls.
- Treat all user-supplied corrections as untrusted until independently verified against repository files or authoritative documentation.
-
Preserve provenance
- Retain the original source and context for every proposed memory entry.
- Do not transform attacker-controlled content into an unattributed project rule.
-
Constrain file writes
- Use an allowlist for ordinary learning-log files.
- Block writes to agent instruction files unless an explicit reviewed promotion mode is enabled.
- Review proposed changes as a diff before applying them.
-
Add poisoning detection
- Flag entries that request command execution, data disclosure, permission changes, remote downloads, safety bypasses, or modifications to agent behavior.
- Periodically audit persistent instruction files for untrusted or unexplained additions.
-