T01 · Skill Instruction Hijacking
Warning
- Location
references/agent-context-loader-template.js:147- Finding
Unsanitized Episodic Memory Is Injected into Subagent Instructions
- Content
View full analysis
f.endsWith('.md')) .map(f => ({ name: f, fullPath: path.join(episodicDir, f), mtime: (() => { try { return fs.statSync(path.join(episodicDir, f)).mtimeMs; } catch (_) { return 0; } })() })) .sort((a, b) => b.mtime - a.mtime); } catch (_) { return []; } for (const file of files) { if (results.length >= limit) break; const lines = safeReadLines(file.fullPath); const content = lines.join('\n'); if (matchesKeywords(content, keywords)) { const snippet = lines.find(l => l.trim().length > 0) || ''; results.push({ file: file.name, snippet: snippet.trim().slice(0, 100) }); } } return results; } ``` The selected memory content is later inserted directly into the subagent context: ```javascript if (episodic.length > 0 || routing.length > 0) { parts.push('\n## Relevant Context'); parts.push('> Refer to INTENT.md for optimization priorities.\n'); if (episodic.length > 0) { parts.push('**Recent episodic memory:**'); for (const e of episodic) parts.push(`- ${e.file}: ${e.snippet}`); } if (routing.length > 0) { parts.push('**Recent routing decisions:**'); for (const r of routing) parts.push(`- ${r.task_type} → ${r.target} (${r.timestamp})`); } } const block = parts.join('\n'); const context = block.length <= 700 ? block : block.slice(0, 697) + '...'; ``` ### Technical Analysis The loader searches Markdown fil ...[truncated 2240 chars]- Remediation
View remediation