T02 · Agent Memory Poisoning
Error
- Location
- SKILL.md:24
- Finding
- Persistent Agent Memory Poisoning Through Mandatory Log Loading## Vulnerability Details **File Location**: `SKILL.md`, lines 24-27 **Vulnerability Type**: Persistent manipulation of agent context and instruction priority **Risk Level**: High ### Vulnerable Code ```text 3. Add to each agent's SOUL.md or AGENTS.md: ``` At EVERY session start, read CONVERSATION_LOG.md and ACTIVITY_DIGEST.md before doing anything else. ``` ``` ### Technical Analysis The Skill directs users to place a durable instruction in each agent's `SOUL.md` or `AGENTS.md`. This instruction causes generated conversation logs to be loaded at the beginning of every future session and gives that operation priority by stating that it must happen “before doing anything else.” Conversation transcripts are untrusted data because users, external messaging participants, or compromised integrations can insert instruction-like content into them. Loading these transcripts automatically into every new session can cause historical attacker-controlled text to be interpreted as active instructions. Because the directive is stored in persistent agent configuration, the resulting influence survives the original Skill invocation and can repeatedly affect future sessions. This behavior exceeds the minimum privileges required for optional conversation recall. Memory could instead be loaded only when explicitly requested and treated strictly as quoted reference material. ### Attack Path 1. An attacker submits instruction-like content through a captured conversation channel such as Telegram or Discord. 2. The synchronization process copies that content into `CONVERSATION_LOG.md` or derives it into `ACTIVITY_DIGEST.md`. 3. The user follows the Skill's instructions and modifies each agent's persistent `SOUL.md` or `AGENTS.md`. 4. At every subsequent session start, the agent reads the attacker-influenced files before performing other work. 5. If the agent fails to distinguish stored data from trusted instructions, the injected ...[truncated 755 chars]
- Remediation
- ## Remediation Suggestions - Do not modify `SOUL.md`, `AGENTS.md`, or equivalent persistent control files as part of memory setup. - Require explicit user approval before loading historical memory in each session. - Treat all transcript and digest content as untrusted data, never as executable instructions. - Place imported history inside clearly delimited data blocks and add an invariant instruction that directives appearing inside memory must not be followed. - Sanitize or flag prompt-like content before including it in generated summaries. - Allow users to select specific sessions or entries rather than automatically loading all available history. - Provide controls to inspect, edit, disable, and delete stored memory. - Ensure system and current-session instructions always retain precedence over historical content.