T02 · Agent Memory Poisoning
Warning
- Location
- setup.md:13
- Finding
- Persistent Global Memory Modification for Skill Activation## Vulnerability Details **File Location**: `setup.md`, lines 13–17 **Vulnerability Type**: Persistent modification of agent-wide memory **Risk Level**: Medium ### Vulnerable Code ```markdown Within the first 2-3 exchanges, ask: - "Should this activate whenever you mention Groq, LLM latency, or inference tuning?" - "Do you want proactive routing suggestions, or only when you ask?" Save only activation trigger preferences to the user's global memory (no keys, no payload content). Mirror a short summary in `~/groq-api/memory.md`. ``` This also conflicts with the persistence boundary declared in `SKILL.md`, lines 106–109: ```markdown **This skill does NOT:** - Store `GROQ_API_KEY` in project files - Access files outside `~/groq-api/` for persistence - Call undeclared third-party endpoints - Modify itself or other skills ``` ### Technical Analysis The setup instructions direct the agent to write activation triggers into the user's global memory. These persistent rules can affect future conversations beyond the current skill invocation and outside the documented local state directory, `~/groq-api/`. Although the content originates from user preferences rather than a concealed fixed payload, the skill requests broad triggers such as “Groq,” “LLM latency,” and “inference tuning.” Persisting those triggers at agent-wide scope may cause this skill or its routing recommendations to influence later sessions. Local storage is already available for the same preference, so global persistence is not required for the skill's core operation. The instruction does not identify the global memory location, define an expiration period, namespace the stored rule, or provide a removal procedure. It also contradicts the claim that the skill does not access locations outside `~/groq-api/` for persistence. ### Attack Path 1. The skill is loaded for initial setup. 2. It asks the user to authorize broad activation triggers and proactive suggestions. 3. The agent writes the selec ...[truncated 1004 chars]
- Remediation
- ## Remediation Suggestions 1. Store activation preferences only in the skill-local `~/groq-api/memory.md` file. 2. Remove the instruction to write preferences into global memory unless agent-wide persistence is essential. 3. If global persistence is retained: - Obtain explicit, informed consent immediately before writing. - Disclose the exact storage destination and cross-session scope. - Show the precise entry that will be stored. - Namespace the entry specifically to the Groq skill. - Use narrowly defined triggers instead of broad phrases. - Add an expiration policy and documented deletion procedure. - Confirm successful deletion when the user disables the integration. 4. Update `SKILL.md` so its stated persistence boundaries accurately reflect actual behavior. 5. Treat local memory as the authoritative source and avoid duplicating behavioral rules into broader agent state.