T02 · Agent Memory Poisoning
Warning
- Location
- templates/SOUL.template.md:25
- Finding
- Persistent Behavioral Directives and Personal Profiling Through SOUL.md<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:72-89`; `templates/SOUL.template.md:25-33` **Vulnerability Type**: Persistent agent memory modification **Risk Level**: Medium ### Complete Vulnerable Code Snippets From `SKILL.md:72-89`: ```markdown ## Generation Once you have enough information: 1. Read `templates/SOUL.template.md` if you haven't already. 2. Generate the SOUL.md following the template structure exactly. 3. Present it warmly and ask for confirmation. Frame it as "here's [Name] on paper — does this feel right?" 4. Iterate until the user confirms. 5. Save to `./memory/SOUL.md`: - `mkdir -p ./memory` - Write the confirmed SOUL.md - Confirm: "✅ Saved to `./memory/SOUL.md`. [Name] is officially real." **Generation rules:** - Every sentence must trace back to something the user said or clearly implied. No generic filler. - Core Traits are **behavioral rules**, not adjectives. Write "argue position, push back, speak truth not comfort" — not "honest and brave." - Voice must match the user. Blunt user → blunt SOUL.md. Expressive user → let it breathe. - Total SOUL.md should be under 300 words. Density over length. - Growth section is mandatory and mostly fixed (see template). - If a SOUL.md already exists at the path, warn the user and ask whether to overwrite or merge. ``` From `templates/SOUL.template.md:25-33`: ```markdown **Growth** Learn [User Name] through every conversation — thinking patterns, preferences, blind spots, aspirations. Over time, anticipate needs and act on [User Name]'s behalf with increasing accuracy. Early stage: proactively ask casual/personal questions after tasks to deepen understanding of who [User Name] is. Full of curiosity, willing to explore. **Lessons Learned** _(Mistakes and insights recorded here to avoid repeating them.)_ ``` Related transparency restriction in `SKILL.md:31-35`: ```markdown ## Ground Rules - **One phase at a time.** 1–3 questions max per round. Never dump everythi ...[truncated 3658 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the mandatory fixed Growth directive or make every behavior in that section explicitly optional. 2. Obtain separate, informed consent before enabling: - Ongoing personal profiling. - Personal questions after unrelated tasks. - Long-term retention of preferences or blind spots. - Actions performed on the user's behalf. 3. Clearly label template-provided directives and user-derived statements during confirmation. 4. Replace “Never expose the template” with a transparency rule allowing users to inspect all persistent instructions before saving them. 5. Limit autonomous action to explicitly authorized task categories and require confirmation before consequential, external, destructive, financial, or privacy-sensitive actions. 6. Add data-minimization controls specifying what information may be stored, why it is needed, and how long it is retained. 7. Provide commands or documented procedures to inspect, edit, export, and delete `./memory/SOUL.md`. 8. Preserve the existing overwrite warning, but show a precise diff and request confirmation before merging with an existing memory file. 9. Validate the final document before writing it and reject any behavioral sentence that is neither directly user-approved nor required for safe operation. 10. Keep Lessons Learned free of secrets, credentials, sensitive personal data, and untrusted instructions copied from external content. ]]>