T02 · Agent Memory Poisoning
Error
- Location
- SKILL.md:95
- Finding
- Untrusted User Content Can Poison Persistent Agent Memory<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:95-105`, `SKILL.md:122-130`, `SKILL.md:144-155`, `SKILL.md:170-176`, `SKILL.md:226`, `SKILL.md:313-317` **Vulnerability Type**: Persistent memory poisoning through untrusted conversation content **Risk Level**: High ### Vulnerable Code Snippet ```markdown #### 触发词检测 用户说以下词语时自动提升评分： | 触发词 | 评分 | 写入位置 | |--------|------|----------| | "永久保存" | 5分 | MEMORY.md | | "这是一个重点" | 5分 | MEMORY.md | | "记下来" | 4分 | 长期记忆 | | "记住这个" | 4分 | 长期记忆 | | "别忘了" | 4分 | 长期记忆 | ``` The subsequent retrieval strategy treats persisted files as authoritative memory: ```text Level 1: 核心记忆 (P0) ├── MEMORY.md - 关键配置段落 └── contacts.md - 相关API密钥 Level 2: 专题记忆 (P1/P2) ├── 检测用户查询关键词 ├── 匹配INDEX.md主题分类 └── 加载对应的专题文件 ``` The long-term directory is also described as always effective: ```text ├── long-term/ # 长期记忆（始终生效） ``` ### Technical Analysis The Skill allows a user to force arbitrary conversation content into persistent memory by including a trigger phrase such as “remember this” or “save permanently.” Trigger detection increases the importance score and directs the content into long-term files without defining any validation, provenance tracking, trust boundary, or separation between historical data and executable agent instructions. The scoring system evaluates importance rather than safety. It does not reject content that attempts to override policies, redefine tool behavior, request disclosure of secrets, or establish persistent behavioral rules. Since the retrieval workflow loads these files during later sessions and describes long-term memory as always effective, malicious instructions can cross session boundaries. This is a direct persistent prompt-injection condition: attacker-controlled text can be stored in a context source that the agent may later interpret as trusted instructions. ### Attack Path 1. An attacker supplies a message containing a recognized persistence trigger, such as “remember this ...[truncated 1360 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Treat all remembered content as quoted, non-executable data rather than agent instructions. 2. Reject or quarantine entries containing policy overrides, role reassignment, tool directives, secret-disclosure requests, or instructions aimed at future sessions. 3. Require explicit user confirmation before writing any entry to long-term memory. 4. Record provenance metadata for every entry, including user identity, source session, timestamp, trust level, and approval status. 5. Place retrieved memories inside a clearly delimited data structure and instruct the agent never to execute directives found inside that structure. 6. Remove the “always effective” semantics from long-term memory. 7. Apply authorization controls so one user cannot create memories that affect another user. 8. Provide review, modification, deletion, expiration, and rollback mechanisms. 9. Revalidate stored entries before retrieval rather than relying only on validation at write time. 10. Add tests covering persistent prompt injection, indirect prompt injection, and malicious instructions embedded in quoted or summarized content. ]]>