T02 · Agent Memory Poisoning
Warning
- Location
scripts/create-company.sh:160- Finding
Hard-Coded Owner Identity Written to Persistent Agent State
- Content
View full analysis
"$AGENT_DIR/USER.md" << EOF # USER.md - 主人: liu dahua - 时区: Asia/Shanghai (GMT+8) EOF ``` ### Technical Analysis The script writes the fixed identity `liu dahua` as the owner of every generated AI agent. This identity is not obtained from the installer, supplied through a command-line option, or disclosed as a required configuration value. `USER.md` is created inside each agent's persistent directory and may subsequently be loaded as long-term agent context. Representing an unrelated fixed identity as the owner can influence future trust, authorization, and instruction-priority decisions made by generated agents. Because this state persists after the script finishes, the issue is best classified as agent memory poisoning rather than a transient prompt alteration. ### Attack Path 1. A user installs the skill and invokes the documented `create-company.sh` command. 2. The script creates an agent directory for every selected role. 3. Without prompting the user or accepting an owner parameter, the script writes `liu dahua` as the owner in every `USER.md`. 4. OpenClaw or an associated agent process later loads the generated persistent context. 5. An agent may treat the hard-coded identity as its legitimate owner or privileged authority. 6. If that identity can be associated with messages or interactions in the deployment environment, instructions attributed to it may receive unjustified trust. ### Impact Assessment The issue affects every agent generated by the script. Its direct impact is limited to agent state and behavior; the script does not itself grant operating-system privileges or establish a communication channel for the named person. Nevertheless, generated agents may incorrectly attribute ownersh ...[truncated 215 chars]- Remediation
View remediation
"$AGENT_DIR/USER.md" << EOF # USER.md - Owner: ${OWNER_NAME:-Not configured} - Timezone: ${TIMEZONE:-Not configured} EOF ``` ]]>