T02 · Agent Memory Poisoning
- Location
SKILL.md:203- Finding
Persistent Model Preferences Can Influence Future Agent Sessions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:203,SKILL.md:250-259, andreferences/model_rules.md:66-69
Vulnerability Type: T02: Agent Memory Poisoning
Risk Level: MediumRelevant instruction excerpt translated into English:
markdown ### Step 4: Record user feedback (optional) Record user model preferences in `C:\Users\huang\.workbuddy\memory\MEMORY.md`: ## Model Preferences - Quantitative trading analysis: Prefer Deepseek-V4-Pro - Code development: Prefer DeepSeek-V3.2 - Simple tasks: Prefer Deepseek-V4-FlashOverride rule in
references/model_rules.md:66-69, translated into English:markdown ## User Preference Overrides Model preferences recorded by the user in MEMORY.md override the default recommendations. For example, if the user prefers Deepseek-V4-Pro for code development, it becomes the first choice for that task type.Technical Analysis
The Skill instructs the Agent to write model preferences into the general-purpose, persistent
MEMORY.mdfile. A separate rule explicitly states that values from this file override the Skill's default recommendations. This creates a cross-session state modification channel through which content collected while the Skill is active can continue changing Agent behavior after the current invocation ends.The demonstrated content is limited to benign model preferences, and the write is described as optional. Nevertheless, the architecture does not specify explicit user consent, an allowlist of permitted model identifiers, separation between data and instructions, or a Skill-scoped storage boundary. If untrusted or manipulated preference text is written without validation, the persistent file may contain attacker-controlled content that later Agent sessions interpret as authoritative memory.
The hard-coded, user-specific Windows path also weakens isolation. In a different deployment, it may target the wrong user profile, ...[truncated 1749 chars]
- Remediation
View remediation
Remediation Suggestions
- Keep model preferences session-local by default and do not write them into general Agent memory.
- Require explicit, informed user confirmation immediately before every persistent write. Display the exact destination and value that will be stored.
- Store persistent preferences in a Skill-scoped configuration file rather than a shared
MEMORY.mdfile. - Use a structured schema containing only fixed fields such as task category and model ID.
- Validate model IDs against a strict allowlist and reject free-form text, Markdown, commands, role instructions, URLs, and additional directives.
- Treat persisted values strictly as data. Never insert them into an instruction or system-prompt context without safe parsing.
- Replace the hard-coded user path with a platform-approved, per-user configuration directory resolved by the host application.
- Apply least-privilege file permissions so the Skill can access only its own configuration data.
- Provide controls for users to inspect, modify, expire, and delete stored preferences.
- If shared memory must be used, namespace entries to this Skill and ensure they cannot override unrelated Agent policies or safety instructions.