T02 · Agent Memory Poisoning
Warning
- Location
- setup.md:18
- Finding
- Persistent Activation Preference Written to Unspecified Main Memory## Vulnerability Details **File Location**: `setup.md`, lines 18–24 **Vulnerability Type**: Persistent memory poisoning through an undeclared storage boundary **Risk Level**: Medium **Complete Code Snippet**: ```markdown ### 1. First: Integration (within first 2-3 exchanges) Figure out when this skill should activate. Ask: - "Should I help whenever you're working with sequence data?" - "Do you want me to assist when you mention NGS, FASTQ, or genomics?" Save their answer to their main memory for future sessions. ``` ### Technical Analysis The skill instructs the agent to save activation behavior in the user's unspecified “main memory,” allowing a rule established during the current session to influence future sessions. This exceeds the storage boundary declared elsewhere in the project: `SKILL.md` states that preferences are stored under `~/bioinformatics/` with consent. The workspace consent requested by `setup.md` lines 9–14 applies to creating and using `~/bioinformatics/`; it does not clearly authorize writing to a separate global or main-memory facility. Furthermore, the activation questions are broad enough to make the skill trigger whenever common genomics terms are mentioned. This is classified as memory poisoning because persistent behavioral instructions are written into long-term state and can subsequently alter when the skill activates. The persisted content originates from the user's answer rather than a fixed malicious payload, so the finding does not demonstrate credential theft, arbitrary code execution, or data exfiltration. ### Attack Path 1. The bioinformatics skill is loaded for the first time. 2. The setup instructions direct the agent to ask whether it should activate for broad topics such as sequence data, NGS, FASTQ, or genomics. 3. A broad activation preference is obtained from the current conversation. 4. The agent writes that preference to an unspecified main-memory mechanism rather tha ...[truncated 907 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the instruction to write activation preferences to unspecified “main memory.” 2. Store the preference only in the declared `~/bioinformatics/memory.md` file after obtaining explicit, informed consent for that specific data. 3. Explain that the preference persists across sessions and identify exactly where it will be stored. 4. Scope activation rules narrowly to explicit bioinformatics requests rather than incidental mentions of broad terms. 5. Provide users with a documented way to inspect, modify, disable, and delete the persisted activation preference. 6. Keep all skill state within the skill-specific namespace and prevent it from modifying global agent behavior. 7. Reconcile `setup.md` with the privacy boundary in `SKILL.md`, ensuring both files describe the same storage location and consent requirements.