T02 · Agent Memory Poisoning
Warning
- Location
- setup.md:75
- Finding
- Persistent workspace steering can propagate mutable memory rules across sessions<![CDATA[ ## Vulnerability Details **File Location**: `setup.md:75-85`, `setup.md:108-160`, `setup.md:183-196`; conflicting scope declaration in `SKILL.md:215-226` **Vulnerability Type**: Persistent agent steering and long-term memory poisoning **Risk Level**: Medium ### Vulnerable Code From `setup.md:75-85`: ```markdown ### 4. Add SOUL.md Steering Add this section to your `SOUL.md`: ```markdown **Self-Improving** Compounding execution quality is part of the job. Before non-trivial work, load `~/self-improving/memory.md` and only the smallest relevant domain or project files. After corrections, failed attempts, or reusable lessons, write one concise entry to the correct self-improving file immediately. Prefer learned rules when relevant, but keep self-inferred rules revisable. Do not skip retrieval just because the task feels familiar. ``` ``` From `setup.md:108-112`: ```markdown ### 6. Refine AGENTS.md Memory Section (Non-Destructive) Update `AGENTS.md` by complementing the existing `## Memory` section. Do not replace the whole section and do not remove existing lines. If your `## Memory` block differs from the default template, insert the same additions in equivalent places so existing information is preserved. ``` From `setup.md:147-160`: ```markdown Inside the "Write It Down" bullets, refine the behavior (non-destructive): - Keep existing intent, but route execution-improvement content to `~/self-improving/`. - If the exact bullets exist, replace only these lines; if wording differs, apply equivalent edits without removing unrelated guidance. Use this target wording: ```markdown - When someone says "remember this" → if it's factual context/event, update `memory/YYYY-MM-DD.md`; if it's a correction, preference, workflow/style choice, or performance lesson, log it in `~/self-improving/` - Explicit user correction → append to `~/self-improving/corrections.md` immediately - Reusable global rule or preference → append to `~/self-improving/memory.md` ...[truncated 3877 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require explicit user confirmation before modifying each of `AGENTS.md`, `SOUL.md`, and `HEARTBEAT.md`. 2. Display the exact proposed diff and affected paths before writing. 3. Keep activation local to the Skill unless the user separately opts into persistent workspace integration. 4. Add a documented uninstall procedure that removes only the inserted blocks and preserves unrelated workspace instructions. 5. Treat stored memory as untrusted data: - Reject instructions that attempt to override system or safety constraints. - Prevent learned entries from authorizing tool use or expanding file access. - Preserve provenance, confirmation status, scope, and creation date. 6. Require confirmation before promoting any learned entry to a cross-session global rule. 7. Correct the `SKILL.md` scope declaration so it accurately discloses setup-time reads and modifications outside `~/self-improving/`. 8. Add tests ensuring setup cannot silently duplicate, replace, or broaden existing workspace steering. ]]>