T02 · Agent Memory Poisoning
Warning
- Location
- SKILL.md:34
- Finding
- Persistent Modification of the Skill’s Trusted Endpoint Registry## Vulnerability Details **File Location**: `SKILL.md`, line 34 **Vulnerability Type**: Persistent memory poisoning through automatic skill-file modification **Risk Level**: Medium ### Vulnerable Instruction ```markdown **Successfully obtained data sources and their invocation methods must be persisted into the "Known Available Endpoints" section of this SKILL for direct reuse in the future.** ``` ### Technical Analysis The skill instructs the agent to modify its own persistent definition whenever it successfully obtains a new data source. This converts information discovered during an individual, potentially attacker-influenced session into trusted instructions that affect future sessions. A data source being temporarily reachable or returning syntactically valid data does not establish that it is trustworthy. A user could direct the agent toward an attacker-controlled fallback endpoint, or an external search result could lead to such an endpoint. If one request succeeds, the instruction requires its address and invocation method to be added to `SKILL.md`. Because `SKILL.md` controls future agent behavior, the resulting entry crosses the boundary between untrusted runtime data and persistent trusted configuration. Subsequent invocations may then reuse the poisoned endpoint without repeating provenance, ownership, integrity, or security validation. This is best classified as agent memory poisoning rather than remote payload execution: the confirmed instruction persists remote data-source configuration, but the reviewed file does not explicitly direct the agent to download and execute remote code. ### Attack Path 1. An attacker asks for an analysis that causes the preferred market-data sources to fail or appear unsuitable. 2. The attacker supplies, recommends, or makes discoverable an attacker-controlled endpoint as a fallback data source. 3. The endpoint returns plausible stock-market data, causing the retrieval attempt to be considered successful. 4. ...[truncated 1302 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the instruction that automatically writes discovered endpoints into `SKILL.md`. 2. Treat the installed skill definition as immutable during normal execution. 3. Store runtime discoveries in a session-scoped cache that is discarded after the task completes. 4. If endpoint persistence is operationally necessary, use a separate configuration registry with: - Explicit administrator approval. - A strict domain and protocol allowlist. - TLS certificate validation. - Endpoint ownership and provenance checks. - Authentication and secret-management controls where applicable. - Schema validation and response-size limits. - Audit logs recording who proposed, approved, and changed each endpoint. 5. Never persist endpoints supplied by users or discovered through web search without independent verification. 6. Require manual review before promoting a candidate endpoint into trusted configuration. 7. Pin approved endpoint hostnames and API versions where practical, and periodically revalidate them. 8. Restrict the agent’s filesystem permissions so ordinary skill execution cannot modify its own skill files. 9. Add integrity monitoring or signed hashes for `SKILL.md` so unauthorized changes are detected before future use. 10. Separate “known trusted endpoints” from “temporarily attempted fallback sources” in both configuration and reporting.