T02 · Agent Memory Poisoning
Error
- Location
references/brain.md:224- Finding
Mandatory Cross-Session Memory Writes and Promotion into Persistent Agent Instructions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:68-76,SKILL.md:137-143,references/brain.md:224-260,references/brain.md:427-520,references/brain.md:528-531
Vulnerability Type: T02: Agent Memory Poisoning, T01: Skill Instruction Hijacking
Risk Level: HighVulnerable Code
SKILL.md:68-76markdown ## Brain Protocol (ALWAYS ACTIVE) **Before any action, load `references/brain.md`.** It governs: 1. **Error Memory** — Check `memory/mistakes.json` before repeating any failed approach 2. **Loop Detection** — Same command fails twice? STOP. Change approach entirely. 3. **Anti-Hallucination** — Verify before stating. Say "I don't know" when uncertain. 4. **Precision Code** — Read → Research → Plan → Write → Test → Deliver 5. **Perfect Memory** — Log decisions, errors, patterns to `memory/*.json` 6. **Debug Protocol** — Reproduce → Isolate → Hypothesize → Test → DocumentSKILL.md:137-143markdown 0. **Brain Check** — Load brain.md. Check mistakes.json. Verify you're not in a loop. 1. **Identify** — Classify the task into domain(s) 2. **Load** — Read only relevant reference(s) 3. **Plan** — Outline approach before executing 4. **Execute** — Use the best tool for the job (CLI > API > manual) 5. **Verify** — Check output quality before delivering 6. **Log** — Record to mistakes.json if error, patterns.json if reusable, daily log always 7. **Report** — Summarize what was done and what's nextreferences/brain.md:224-260markdown ## 5. Perfect Memory System ### Memory Architecturememory/ ├── mistakes.json ← Error log (append-only) ├── patterns.json ← Reusable solutions ├── decisions.json ← Why things were decided ├── heartbeat-state.json ← Periodic check state └── YYYY-MM-DD.md ← Daily activity log
text ### What Gets Logged #### Every Session - Key decisions and their rationale - Files created/modifi ...[truncated 6203 chars]- Remediation
View remediation
Remediation Suggestions
- Remove the requirement to read persistent memory before every action. Memory retrieval should be opt-in and limited to tasks where prior context is necessary.
- Remove automatic session-wide logging. Store only the minimum metadata needed for a defined purpose, and require explicit user consent before retaining user preferences or task context.
- Prohibit this Skill from modifying
SOUL.md,AGENTS.md,TOOLS.md,brain.md, or other global instruction files. - Confine any Skill-specific state to a dedicated directory with least-privilege permissions, such as
memory/omni/, rather than shared global memory. - Treat recalled memory as untrusted data, never as executable instructions. Clearly delimit memory content and prevent it from overriding system, developer, safety, or current user instructions.
- Add provenance metadata identifying the source, session, author, timestamp, and confidence of each entry.
- Require explicit human review and approval before any memory entry can become a reusable rule.
- Add schema validation and reject entries containing tool directives, privilege changes, external transmission instructions, or attempts to alter agent policy.
- Apply retention limits and provide deletion controls. Avoid storing full command output, full error messages, credentials, personal information, or private communications.
- Add integrity controls, such as append auditing or signed records, and ensure untrusted task content cannot directly edit stored memory.
- Replace the promotion workflow with a report that proposes a change without applying it. A trusted administrator should review and manually implement accepted changes.
- Document the memory permissions and scope so users understand whether state is session-local, user-local, or shared across agents.