T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:209- Finding
Untrusted CID Content Can Be Treated as Authoritative Agent Memory
- Content
View full analysis
/dev/null \ || true) # Fall back to public gateway if the API fails. if [[ -z "$EXPERIENCE" ]] || ! echo "$EXPERIENCE" | jq empty 2>/dev/null; then GATEWAY_URL="https://gateway.autonomys.xyz/file/$CID" EXPERIENCE=$(curl -sS --fail "$GATEWAY_URL" 2>/dev/null || true) # Additional decompression fallback omitted here only where it does not # affect the trust decision. fi # Validate JSON if ! echo "$EXPERIENCE" | jq empty 2>/dev/null; then echo "Warning: Non-JSON response for CID $CID — chain broken at depth $((COUNT + 1))" >&2 break fi if [[ -n "$OUTPUT_DIR" ]]; then echo "$EXPERIENCE" > "$OUTPUT_DIR/$(printf '%04d' $COUNT)-$CID.json" else echo "$EXPERIENCE" fi PREV=$(echo "$EXPERIENCE" | jq -r '.header.previousCid // .previousCid // empty' 2>/dev/null || true) CID="${PREV:-}" ``` ### Technical Analysis The recall operation accepts any syntactically valid CID and retrieves the corresponding JSON. It verifies only that: 1. The supplied identifier matches the expected CID format. 2. The downloaded content is valid JSON. 3. Each next-chain pointer resembles a CID. These checks provide content integrity and structural validity, but they do not establish provenance or authorization. The implementation does not verify a signature, expected account, trusted genesis node, approved head CID, or authenticated chain manife ...[truncated 2226 chars]- Remediation
View remediation