T02 · Agent Memory Poisoning
- Location
references/strategy-notes.md:3- Finding
Uncontrolled Persistent Strategy Memory Can Influence Future Sessions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:36-38;references/strategy-notes.md:3-4;references/strategy-notes.md:66-67
Vulnerability Type: T02: Agent Memory Poisoning
Risk Level: MediumVulnerable Snippets
SKILL.md:36-38markdown ## Living know-how See `references/strategy-notes.md` for the evolving playbook. Update it whenever we learn new tactics or notice repetition.references/strategy-notes.md:3-4markdown This file is **the long-term “know-how” memory** for the skill. Update it whenever we learn something new about what works (and what gets repetitive).references/strategy-notes.md:66-67markdown Anti-repeat rule: - Keep a 7-day history; avoid same archetype for the next 2–3 days.Technical Analysis
The skill explicitly designates
references/strategy-notes.mdas long-term memory and instructs the agent to update it whenever new tactics are learned. It also calls for retaining a seven-day history. These instructions create a persistent state channel through which information originating in a user request or external research can become part of the instructions used in later sessions.No trust-boundary validation, provenance tracking, per-user isolation, expiration policy, approval requirement, or restriction on the type of information that may be persisted is specified. Consequently, attacker-controlled content could be interpreted as a useful tactic and written into the strategy file as an enduring behavioral rule.
The issue is an instruction-level persistence weakness rather than arbitrary system-code execution. The reviewed files contain no executable scripts or direct file-writing implementation, so exploitation depends on the hosting agent having permission and tooling to follow the documented update instruction.
Attack Path
- An attacker invokes the writing skill and supplies a purported optimization tactic, formatting pref ...[truncated 1238 chars]
- Remediation
View remediation
Remediation Suggestions
- Make bundled strategy and reference files read-only during normal skill execution.
- Require explicit, informed authorization before persisting any lesson, preference, history, or user-provided content.
- Store preferences in isolated per-user state rather than in a shared skill file.
- Treat persisted entries as untrusted data rather than executable instructions. Use a strict schema with bounded fields and reject entries that attempt to alter safety, compliance, tool use, or system behavior.
- Record provenance, creation time, author or session identity, review status, and expiration for every persisted entry.
- Add a review or approval step before learned tactics become part of the shared strategy.
- Apply precedence rules ensuring that current system instructions, safety requirements, and platform policies always override stored preferences.
- Avoid retaining full user prompts or personal information. Keep only the minimum non-sensitive metadata required for repetition control, with a short retention period.
- If a seven-day history is necessary, store non-reversible archetype identifiers rather than user content and automatically delete expired records.
- Audit existing strategy entries and remove any user-specific, unsupported, or compliance-overriding instructions.