T02 · Agent Memory Poisoning
- Location
SKILL.md:101- Finding
Unsafeguarded Persistence of Session-Derived Rules
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, line 101
Vulnerability Type:T02: Agent Memory Poisoning
Risk Level: MediumComplete Code Snippet:
markdown | 6. 复盘沉淀 | （新增） | 将本轮营销方案/分析报告中的修正经验固化为营销方法论 → 更新策略库与合规清单 → 形成可复用执行清单 |The instruction directs the Agent to turn corrections from the current marketing task into reusable methodology, update a strategy library and compliance checklist, and create reusable execution checklists.
Technical Analysis
This instruction creates a persistent-state integrity risk because session-derived content may be incorporated into stores that influence subsequent tasks. It does not define:
- The exact storage destination or persistence boundary
- Whether storage is isolated by user, organization, or workspace
- A requirement for explicit user approval before writing
- Trusted-source validation or review of proposed rules
- Provenance, authorship, and timestamp metadata
- Expiration, versioning, rollback, or deletion controls
- Restrictions preventing user-supplied content from becoming authoritative policy
Consequently, inaccurate or adversarial instructions supplied during an ordinary marketing task could be promoted into reusable strategy or compliance rules. The issue does not provide system-level code execution or operating-system persistence; it affects the integrity of Agent-managed long-term state.
Attack Path
- An attacker or untrusted user supplies manipulated marketing material, false compliance guidance, or deliberately misleading corrections.
- The Agent processes those corrections as lessons from the current task.
- Under the reflection instruction, the Agent promotes the corrections into marketing methodology.
- The Agent updates a persistent strategy library or compliance checklist without a mandatory approval or validation step.
- Later tasks reuse the poisoned guidance, causing incorrect recommendations or complianc ...[truncated 761 chars]
- Remediation
View remediation
Remediation Suggestions
- Make reflection output session-local by default and prohibit automatic persistent writes.
- Require explicit, informed user or administrator approval for every proposed persistent update.
- Define the exact storage target and isolate entries by user, organization, and workspace.
- Treat all session-derived rules as untrusted proposals until reviewed against authoritative legal and organizational policies.
- Store provenance metadata, including the source task, submitting user, reviewer, timestamp, and supporting evidence.
- Implement version history, expiration dates, rollback, deletion, and audit logging.
- Prevent user-provided content from directly modifying authoritative compliance rules.
- Separate reusable marketing suggestions from legally authoritative compliance controls.
- Replace the current instruction with language such as:
markdown Produce a session-local reflection summary. Do not update persistent strategy or compliance stores unless the user explicitly requests it and an authorized reviewer approves the proposed changes.