T02 · Agent Memory Poisoning
- Location
SKILL.md:166- Finding
Automatic Persistence of User-Influenced Review Content
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 166–177
Vulnerability Type: T02: Agent Memory Poisoning
Risk Level: MediumVulnerable Code
markdown ## Output After all sections are reviewed, produce a clean summary: **CEO REVIEW SUMMARY** - **Mode:** [selected mode] - **Strongest challenges:** [top 3 issues found] - **Recommended path:** [what to do next] - **Accepted scope:** [what's in] - **Deferred:** [what's out and why] - **NOT in scope:** [explicitly excluded items] Save the summary to `memory/` for future reference.Technical Analysis
The Skill requires the agent to save a review summary into the persistent
memory/location. The summary is derived from plans and other content supplied by the user, so an attacker may influence what is persisted.No instruction requires the agent to sanitize the summary, distinguish user-provided statements from trusted instructions, obtain confirmation before writing, apply retention limits, or prevent imperative text from being stored. Consequently, hostile content embedded in a reviewed plan could be incorporated into persistent memory and later interpreted as trusted context.
The persistence instruction is unnecessary for producing the requested review and conflicts with the Skill's otherwise read-only posture, including its prohibition on making changes.
Attack Path
- An attacker submits a plan containing manipulative statements or instructions designed to influence later agent behavior.
- The Skill reviews the attacker-controlled plan and incorporates some of its content into the CEO review summary.
- Following the mandatory instruction, the agent saves that summary under
memory/. - A later session loads or consults the persisted summary.
- If the stored content is treated as trusted guidance rather than untrusted historical data, it can influence subsequent decisions or behavior across sessions.
Successful exploitation depends on the surrounding agent plat ...[truncated 616 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the automatic instruction to save the summary under
memory/; return it only in the current response by default. - If persistence is required, obtain explicit user approval before every write and show the exact content and destination.
- Store only a structured allowlist of factual fields rather than unrestricted prose.
- Mark all persisted records with provenance, creation time, source trust level, and expiration time.
- Strip or reject imperative instructions, tool directives, embedded prompts, executable content, and unrelated user-controlled text before persistence.
- Ensure later sessions treat saved summaries as untrusted reference material, never as higher-priority instructions.
- Provide a mechanism to inspect, edit, expire, and delete persisted records.
- Reconcile the persistence behavior with the Skill's “No code changes” and review-only guarantees so its state-changing behavior is explicit and narrowly scoped.
- Remove the automatic instruction to save the summary under