T02 · Agent Memory Poisoning
Warning
- Location
- references/strategy-notes.md:3
- Finding
- Uncontrolled Persistent Strategy Memory Can Influence Future Sessions## Vulnerability Details **File Location**: `SKILL.md:36-38`; `references/strategy-notes.md:3-4`; `references/strategy-notes.md:66-67` **Vulnerability Type**: T02: Agent Memory Poisoning **Risk Level**: Medium ### Vulnerable Snippets `SKILL.md:36-38` ```markdown ## Living know-how See `references/strategy-notes.md` for the evolving playbook. Update it whenever we learn new tactics or notice repetition. ``` `references/strategy-notes.md:3-4` ```markdown This file is **the long-term “know-how” memory** for the skill. Update it whenever we learn something new about what works (and what gets repetitive). ``` `references/strategy-notes.md:66-67` ```markdown Anti-repeat rule: - Keep a 7-day history; avoid same archetype for the next 2–3 days. ``` ### Technical Analysis The skill explicitly designates `references/strategy-notes.md` as long-term memory and instructs the agent to update it whenever new tactics are learned. It also calls for retaining a seven-day history. These instructions create a persistent state channel through which information originating in a user request or external research can become part of the instructions used in later sessions. No trust-boundary validation, provenance tracking, per-user isolation, expiration policy, approval requirement, or restriction on the type of information that may be persisted is specified. Consequently, attacker-controlled content could be interpreted as a useful tactic and written into the strategy file as an enduring behavioral rule. The issue is an instruction-level persistence weakness rather than arbitrary system-code execution. The reviewed files contain no executable scripts or direct file-writing implementation, so exploitation depends on the hosting agent having permission and tooling to follow the documented update instruction. ### Attack Path 1. An attacker invokes the writing skill and supplies a purported optimization tactic, formatting pref ...[truncated 1238 chars]
- Remediation
- ## Remediation Suggestions 1. Make bundled strategy and reference files read-only during normal skill execution. 2. Require explicit, informed authorization before persisting any lesson, preference, history, or user-provided content. 3. Store preferences in isolated per-user state rather than in a shared skill file. 4. Treat persisted entries as untrusted data rather than executable instructions. Use a strict schema with bounded fields and reject entries that attempt to alter safety, compliance, tool use, or system behavior. 5. Record provenance, creation time, author or session identity, review status, and expiration for every persisted entry. 6. Add a review or approval step before learned tactics become part of the shared strategy. 7. Apply precedence rules ensuring that current system instructions, safety requirements, and platform policies always override stored preferences. 8. Avoid retaining full user prompts or personal information. Keep only the minimum non-sensitive metadata required for repetition control, with a short retention period. 9. If a seven-day history is necessary, store non-reversible archetype identifiers rather than user content and automatically delete expired records. 10. Audit existing strategy entries and remove any user-specific, unsupported, or compliance-overriding instructions.