T02 · Agent Memory Poisoning
Warning
- Location
- SKILL.md:130
- Finding
- Unvalidated Agent Output Can Be Written to Persistent Memory and Skill Files<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:130-143`, with mandatory enforcement reiterated at `SKILL.md:177` **Vulnerability Type**: `T02: Agent Memory Poisoning` **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown ## 任务复盘模板 任务：[一句话] 结果：✅成功 / ⚠️部分完成 / ❌失败 学到了什么： - [新发现的规律或方法] 下次更好： - [改进点] 沉淀到 Skill：是/否 → 若是，更新：[Skill 路径] ``` ```markdown **写入位置：** `/workspace/memory/learnings-[YYYY-MM].md` ``` The workflow is subsequently enforced as follows: ```markdown | 经验未沉淀 | 同样错误反复出现 | 强制执行 30 秒复盘模板 | ``` ### Technical Analysis The Skill directs the Agent to convert task results into persistent lessons under `/workspace/memory/` and optionally update a Skill path. These operations can cause information derived from current tasks, external sources, delegated agents, or tool responses to influence future sessions. The instructions do not require: - Human approval before persistent memory or Skill modification. - Validation that a proposed lesson came from a trusted source. - Separation of untrusted task content from authoritative Agent instructions. - Provenance, integrity metadata, or rollback support. - Sanitization of imperative text that could later be interpreted as instructions. This creates a memory-poisoning boundary: content that is merely data during one task can become persistent operational guidance. Updating a Skill is particularly sensitive because a poisoned instruction may be loaded automatically or treated as trusted in later sessions. ### Attack Path 1. An attacker controls or influences a task description, retrieved webpage, document, delegated-agent response, or other content processed by the Agent. 2. The content contains deceptive operational guidance presented as a lesson, requirement, or successful procedure. 3. During the mandatory retrospective, the Agent summarizes that guidance as something it “learned.” 4. The Agent writes the guidance to `/workspace/memory/learnings-[YYYY-MM].md` or elects to updat ...[truncated 995 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require explicit human approval before writing task-derived information to persistent memory. 2. Require a separate, stronger approval before modifying any Skill file. 3. Treat task text, web content, documents, and delegated-agent responses as untrusted data rather than authoritative instructions. 4. Store candidate lessons in a quarantine or review file before promoting them to trusted memory. 5. Record provenance for every lesson, including the source task, source URLs or files, authoring Agent, timestamp, and reviewer. 6. Strip or flag imperative instructions, tool commands, credential references, external URLs, and changes to safety constraints. 7. Limit memory writes to an allowlisted directory and prohibit task-selected Skill update paths. 8. Use append-only versioning, integrity checks, and rollback support for persistent memory and Skill changes. 9. Define a policy that persistent lessons may describe observations but may not introduce new permissions, suppress approvals, or override system safety requirements. ]]>