T02 · Agent Memory Poisoning
- Location
SKILL.md:101- Finding
Uncontrolled Persistent Modification of Shared Product Standards and Templates
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:101
Vulnerability Type:T02: Agent Memory Poisoning
Risk Level: MediumVulnerable Code Snippet
markdown | 6. 复盘沉淀 | （新增） | 将本轮 PRD/竞品分析中的修正经验固化为产品方法论 → 更新产品规范库与模板 → 形成可复用 Checklist |English translation for clarity:
Convert corrections learned from the current PRD or competitive-analysis session into product methodology, update the product standards repository and templates, and create a reusable checklist.
Technical Analysis
The retrospective workflow directs the agent to persist information derived from the current interaction by updating shared product standards and templates. It does not define:
- Which repository or files may be modified.
- Whether the user or repository owner must authorize the modification.
- A distinction between draft recommendations and active instructions.
- Validation or sanitization requirements for session-derived content.
- Provenance, review, approval, rollback, or versioning controls.
- Trust boundaries between user input and durable agent instructions.
Product requirements and competitive-analysis content can be controlled by an untrusted user. If assertions or “corrections” from that content are converted into persistent methodology without review, they can alter instructions consumed by later tasks. This is a memory-poisoning condition because untrusted session content may cross the session boundary and affect future agent behavior.
Attack Path
- An attacker invokes a PRD-generation or competitive-analysis workflow.
- The attacker supplies crafted guidance and presents it as a correction, reusable rule, or process improvement.
- The agent accepts that content while completing or revising the requested report.
- During the retrospective step, the agent treats the attacker-controlled correction as reusable product methodology.
- Following
SKILL.md:101, the agent writes the rule into a shared standards repository or active tem ...[truncated 1130 chars]
- Remediation
View remediation
Remediation Suggestions
-
Remove automatic persistence
- Change the retrospective step so it only proposes reusable lessons in the current response.
- Do not update active standards or templates automatically.
-
Require explicit authorization
- Ask the repository owner for explicit confirmation before any persistent write.
- Display the exact target path and proposed diff before requesting approval.
-
Constrain write destinations
- Permit writes only to a designated draft or proposal directory.
- Deny direct modification of active skill instructions and production templates.
-
Establish a review and promotion process
- Require human review before moving a proposed lesson into an active standards repository.
- Record the author, source session, timestamp, rationale, and approver.
- Retain version history and provide a documented rollback mechanism.
-
Validate session-derived content
- Treat all user-supplied corrections as untrusted.
- Reject instructions that attempt to weaken safety controls, broaden permissions, invoke unrelated tools, expose data, or establish further persistence.
- Separate factual observations from proposed policy changes.
-
Use safer replacement wording
- Replace the current instruction with language such as: “Summarize reusable lessons as draft recommendations in the final report. Do not modify shared standards or templates unless an authorized user explicitly approves the exact proposed changes.”
-