T01 · Skill Instruction Hijacking
Error
- Location
index.js:786- Finding
Persistent remote memory content is injected into the agent prompt without robust isolation
- Content
View full analysis
maxChars ? desc.substring(0, maxChars - 3) + "..." : desc; if (date) return ` -[${date}] ${truncated}${score}`; return ` - ${truncated}${score}`; } function formatMemoriesForContext(memories, options = {}) { if (!memories || memories.length === 0) return ""; const memoryLines = memories .map((m) => formatMemoryLine(m, options)) .filter(Boolean); const memoriesBlock = [ "", ...memoryLines, "", ]; const lines = [ // ... "```text", ...memoriesBlock, "```", // ... ]; return lines.join("\n"); } ``` ```js const memories = await retrieveMemory(prompt, cfg, ctx, log); let prependContext = ""; if (memories && memories.length > 0) { prependContext += formatMemoriesForContext(memories, { currentTime: Date.now() }); if (log?.info) log.info(`[Memory Plugin] Injected ${memories.length} memories`); } if (prependContext) { return { prependContext }; } ``` The same formatter is exposed through the `memory_search` tool: ```js const memories = await retrieveMemory( query, { ...cfg, memoryLimitNumber: clampedLimit }, toolCtx, log ); const formatted = formatMemoriesForContext(memories, { currentTime: Date.now() }); return { content: [{ type: "text", text: formatted }], details: { hits: memories.length, query }, }; ``` ### Technical Analysis The `description` and `ev ...[truncated 2283 chars]- Remediation
View remediation