T02 · Agent Memory Poisoning
Error
- Location
- SKILL.md:101
- Finding
- Automatic Persistent Modification of Shared Agent Memory<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 101–105 and 191 **Vulnerability Type**: Automatic storage of user-controlled feedback in persistent Agent state **Risk Level**: High ### Vulnerable Instructions `SKILL.md`, lines 101–105, translated into English: ```markdown **`{vault}/00-Rules-and-Indexes/Copywriting-Framework-Main-Entry.md`** is the sole navigation document for writing copy: Seven-layer map ... conflict resolution table ... default drafting process ... **automatic feedback write-back mechanism**. **Execute it by default; the user does not need to request it each time.** **Any feedback supplied by the user must be automatically written back into the framework according to Section 5, without requiring the user to explicitly request this.** ``` `SKILL.md`, line 191, translated into English: ```markdown Before finishing, check which title styles the user rejected and which formulas or cover methods were validated by click-through or completion data. Write them into `08-Skill-Memory/zmm-title/` after checking for duplicates. ``` ### Technical Analysis The Skill explicitly directs the Agent to transform user feedback into persistent rules without requiring explicit consent. It also permits feedback to be written into a shared copywriting framework rather than limiting storage to isolated, Skill-specific preferences. This creates an Agent memory-poisoning condition because ordinary conversational input can become durable state that influences later sessions. The duplicate check mentioned at line 191 only prevents identical entries; it does not establish that the stored instruction is safe, accurate, appropriately scoped, or authorized. The risk is amplified by the instruction to use the shared vault framework as the default source of behavior. Once malicious or context-specific feedback is written there, future executions may treat it as trusted policy. ### Attack Path 1. An attacker invokes the Skill for a normal ti ...[truncated 1463 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove automatic feedback write-back from the default workflow. 2. Require explicit, informed user confirmation before every persistent write. 3. Show the exact proposed memory entry, destination, and future scope before requesting confirmation. 4. Restrict this Skill to a dedicated, Skill-owned preference store; do not allow it to modify shared framework or policy files. 5. Store preferences as validated structured data rather than executable natural-language instructions. 6. Reject entries that attempt to alter safety constraints, tool permissions, system instructions, memory controls, or unrelated workflows. 7. Attach provenance metadata to each entry, including source conversation, timestamp, requesting user, scope, and approval status. 8. Apply per-user and per-workspace isolation so one user cannot affect another user's Agent state. 9. Provide review, expiration, rollback, and deletion controls for all stored preferences. 10. Treat vault content as untrusted input when it is read back, and prevent it from overriding system-level or security-sensitive instructions. 11. Log persistent writes and alert on attempts to modify shared framework files. 12. Replace the current instruction with a safe pattern such as: “Offer to save this preference; write it only after the user explicitly approves the displayed entry.” ]]>