T02 · Agent Memory Poisoning
Warning
- Location
skill.js:55- Finding
Persistent Prompt Injection Through Unsanitized Decision Notes
- Content
View full analysis
s.trim()).filter(Boolean); const body = `# ${title}\n\n` + `- Tags: ${tags.map(t => `\`${t}\``).join(' ')}\n` + `- Date: ${new Date().toISOString()}\n\n` + `## Decision\n- \n\n## Rationale\n- \n\n## Next actions\n- \n`; fs.writeFileSync(file, body, 'utf8'); ``` ### Technical Analysis The `new-note` command accepts `--title` and `--tag` values from the command line and interpolates them directly into a persistent Markdown document. Although `title` is normalized when constructing the filename, the original value is inserted into the document body without escaping or validation. Tags are similarly trimmed but otherwise remain unrestricted. An attacker able to influence these arguments can include line breaks, Markdown structures, or model-directed instructions. The resulting content is stored under the workspace's `context/` directory. Because this skill is explicitly designed to provide file-based memory and searchable decision notes, a later agent session may retrieve and process the stored content as trusted context. The vulnerable behavior is therefore not filesystem path traversal—the generated filename is constrained—but unsafe persistence of untrusted semantic content into an agent memory channel. Exploitation depends on an attacker being able to control or influence command arguments and on a later agent consuming the generated note. ...[truncated 1536 chars]- Remediation
View remediation