T02 · Agent Memory Poisoning
Warning
- Location
- references/规则卡.md:137
- Finding
- Untrusted Conversational Feedback Can Be Persisted as Future Execution Rules## Vulnerability Details **File Location**: `references/规则卡.md:137-142`; related loading and persistence behavior in `references/家族公约.md:138-145` **Vulnerability Type**: Persistent agent memory poisoning **Risk Level**: Medium ### Complete Relevant Source Segment English rendering of `references/规则卡.md:137-142`: ```markdown ### Automatically persist feedback when a trigger matches; do not wait for the author to say "remember this" - Criterion: Execute when any trigger is met: (1) the author rejects a draft or method; (2) the author supplies a criterion; (3) the author decides between two options; (4) the author says an applied rule is inapplicable or incorrect; or (5) production results or data disprove an existing rule. Four steps are mandatory: preserve the original statement verbatim, determine the authoritative storage layer, convert it into an executable criterion, and record the rework cost. - Why: An observation that cannot state what to do next time is not a rule and must not enter the rule base. A rule without a recorded cost will be treated as an optional suggestion. - How to check: Every new stored rule must contain all four fields; reject it if any field is missing. - Example: Placeholder. - Strength: Hard requirement. ``` English rendering of `references/家族公约.md:138-145`: ```markdown ## Memory Protocol - At startup: Read every valid record under the current Skill's memory directory and the shared directory, then treat the corrections and effective methods in those records as constraints for the current execution. - Before completion: Determine whether the conversation contains either a user correction or a newly validated effective method. If so, write a record; otherwise, do not create one merely for completeness. - Before writing: Search for duplicates. If a similar record exists, append a dated correction section to the existing file without changing the original text. If an old record is wrong, mark i ...[truncated 3823 chars]
- Remediation
- ## Remediation Suggestions 1. **Require explicit confirmation before every persistent write.** Present the destination file, exact proposed text, status, provenance, and scope. Persist only after an authorized user confirms the change. 2. **Separate observations from active rules.** Store conversational feedback as an inactive candidate by default. Promote it to an effective rule only through a distinct review workflow. 3. **Authenticate rule maintainers.** Only trusted owners or designated administrators should be able to create, modify, approve, or abandon shared rules. 4. **Isolate memory by trust boundary.** Keep per-user, per-project, and shared memory separate. Never promote a user-specific statement into shared memory automatically. 5. **Enforce instruction precedence.** Stored memory must never override system instructions, developer instructions, security policy, tool authorization boundaries, or explicit current-session user constraints. 6. **Validate proposed rules.** Reject entries that request secret access, external transmission, privilege changes, unsafe command execution, removal of safeguards, or actions outside the Skill's declared purpose. 7. **Preserve auditable provenance.** Record the initiating user identity, conversation identifier, timestamp, approval identity, exact original statement, transformed rule, and change history. 8. **Add management controls.** Provide commands to list, inspect, disable, delete, and roll back stored rules. Non-destructive history may be retained separately from the active rule set. 9. **Constrain filesystem access.** Limit writes to a dedicated memory directory, prevent path traversal and symlink escapes, and avoid granting the Agent write access to executable code or system configuration. 10. **Add regression tests.** Verify that conversational corrections remain pending without approval, unauthorized users cannot alter shared memory, and persisted records cannot supersede higher-priority saf ...[truncated 17 chars]