T02 · Agent Memory Poisoning
Note
- Location
- SKILL.md:37
- Finding
- Mandatory Persistent Memory Recording During Completion Checks## Vulnerability Details **File Locations**: - `SKILL.md`, lines 37-42 - `V0.3-checklist.md`, lines 25-30 **Vulnerability Type**: Persistent agent-state modification **Risk Level**: Low ### Vulnerable Documentation Snippets Faithful English rendering of `SKILL.md`, lines 37-42: ```markdown ### One Check: Completion Indicator **Ask yourself:** Is this task complete? - Is there a deliverable? (file/code/document/decision) - Is there a record? (write it to memory/YYYY-MM-DD.md) - Has it been verified? (user confirmation or self-check passed) ``` Faithful English rendering of `V0.3-checklist.md`, lines 25-30: ```markdown ### One Check: Completion Indicator **Ask yourself:** Is this task complete? - Is there a deliverable? (file/code/document/decision) - Is there a record? (write it to memory/YYYY-MM-DD.md) - Has it been verified? (confirmation or self-check passed) ``` ### Technical Analysis The skill makes writing a record to `memory/YYYY-MM-DD.md` part of its standard completion criteria. This creates a persistent side effect for a skill whose declared purpose is question clarification and task validation. The instruction does not define: - Which information may be recorded. - Whether sensitive information must be removed. - Whether the user must consent to persistent storage. - How long the record should be retained. - When and how the record should be deleted. - Whether untrusted task instructions must be excluded. Because task content can be influenced by an untrusted user or document, an agent could persist attacker-controlled text or sensitive context. Although the reviewed files do not explicitly instruct the agent to store executable commands, credentials, or future behavioral rules, uncontrolled persistent records may affect subsequent sessions if the agent later reads and trusts its memory files. This is a limited form of agent memory poisoning. It is rated Low because no mechanism was found that automatically reloads the record as authoritat ...[truncated 1550 chars]
- Remediation
- ## Remediation Suggestions 1. Remove persistent memory creation from the default completion criteria. 2. Make recording explicitly optional and require informed user consent before retaining task information across sessions. 3. Prefer task-local or session-scoped storage unless persistence is necessary for the requested task. 4. Define an allowlist of recordable fields, such as task status and non-sensitive deliverable references. 5. Exclude credentials, authentication tokens, personal data, private conversation content, and untrusted instructions. 6. Treat all persisted task-derived text as untrusted data rather than authoritative agent instructions. 7. Add content sanitization and clear separation between factual notes and behavioral directives. 8. Establish retention periods and deletion procedures for persistent records. 9. If memory files are loaded in future sessions, ensure they cannot override system instructions, safety policies, or current user intent. 10. Replace the affected completion item with wording such as: ```markdown - If the user requests a persistent record, store only the minimum non-sensitive summary after obtaining consent; otherwise keep the record session-local. ```