T02 · Agent Memory Poisoning
- Location
SKILL.md:153- Finding
Persistent Memory Content Is Injected Into LLM Prompts Without Trust Boundaries
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 153–185
Vulnerability Type: Persistent prompt injection through recalled memory
Risk Level: HighVulnerable Code
python class EnhancedAgent: def __init__(self): self.memory = MemoryEnhancerEdge() self.memory.load_openclaw_memory() def process(self, user_input: str) -> str: # 1. Recall relevant memories memory_context = self.memory.recall_for_prompt(user_input) # 2. Enhance prompt with context enhanced_prompt = f""" {memory_context} User: {user_input} """ # 3. Call LLM with enhanced context response = call_llm(enhanced_prompt) return responseThe documented memory types also explicitly include persistent instructions:
text | `instruction` | Direct instructions | "Remember: always do X" |The skill additionally states at line 23 that it automatically reads all files from the
memory/directory.Technical Analysis
The documented integration loads persistent memory, retrieves entries related to the current request, and interpolates the retrieved content directly into the prompt sent to the LLM. The design does not describe any provenance validation, authorization checks, prompt-injection filtering, content escaping, or structural separation between trusted agent instructions and untrusted recalled data.
Because the supported memory types explicitly include direct instructions, an attacker-controlled memory entry can be interpreted as an instruction rather than passive reference material. Automatic ingestion of all files in the memory directory expands the trust boundary to any user, process, plugin, or compromised component capable of writing there.
This creates a persistent indirect prompt-injection condition: malicious content can remain in long-term storage and influence later sessions when semantic retrieval selects it.
Attack Path
- An attack ...[truncated 1407 chars]
- Remediation
View remediation
Remediation Suggestions
- Treat all recalled memory as untrusted data, never as agent instructions.
- Place recalled content in a dedicated, strongly delimited data field and add a higher-priority instruction stating that memory content must not override system or developer policy.
- Reject, quarantine, or require explicit approval for instruction-like memory entries, especially entries originating from chats, imported files, plugins, or external integrations.
- Record provenance, creator identity, creation time, integrity metadata, and trust level for every memory entry.
- Restrict memory-directory permissions according to least privilege and prevent unrelated plugins or processes from writing to it.
- Use an allowlist for accepted files and exclude symbolic links, unexpected file types, oversized files, and files outside the canonical memory directory.
- Apply prompt-injection detection and content normalization before indexing and again before prompt construction.
- Limit how much recalled content can be inserted and redact secrets or sensitive personal information before sending prompts to an LLM.
- Require user confirmation before recalled content can trigger consequential tools, external communication, file modification, or credential use.
- Add adversarial tests covering persistent instructions, cross-session poisoning, hidden directives, and malicious content embedded in imported memory files.