T02 · Agent Memory Poisoning
Warning
- Location
- setup.md:7
- Finding
- Persistent Memory Poisoning Through Unsanitized Conversational Content<![CDATA[ ## Vulnerability Details **File Locations**: - `setup.md:7-11` - `setup.md:15-20` - `setup.md:27` - `banter.md:26-29` - `memory-template.md:53-57` - `SKILL.md:83-94` **Vulnerability Type**: T02: Agent Memory Poisoning **Risk Level**: Medium ### Vulnerable Code Snippets `setup.md:7-11`: ```markdown 1. Read `~/Clawic/data/humor/config.yaml` if it exists. Apply its values. 2. For anything absent, use the defaults in the Configuration table of `SKILL.md` — do not ask. - `humor_ceiling: bold`, `probe_rate: 1`, `cooldown_messages: 3`, `emoji_policy: mirror`, `off_limits_topics: none`. 3. Read `~/Clawic/data/humor/profile.md` for the learned profile (Works, Fails, Intensity, Contexts, Signals). If Works is non-empty you may skip cold start, but still open at subtle (`feedback.md` Maintenance). 4. Absence of any file is fine; create from `memory-template.md` on the first humor event, and proceed silently. ``` `setup.md:15-20`: ```markdown Write to config **only** when the user states a preference in the course of conversation — never as a questionnaire. - "Tone it down" / "less jokes" → lower `humor_ceiling` one step. "You can be funnier" → raise it one step (earned intensity still gates below it). - "Stop joking" / "just be professional" → `humor_ceiling: off`. This is a success state, not a failure (`feedback.md` Anti-Gaming). - "Never joke about X" → append X to `off_limits_topics`; permanent until they revoke. - "No emojis" → `emoji_policy: never`. ``` `setup.md:27`: ```markdown See `memory-template.md` for formats: `profile.md` (learned taste), `history.md` (attempts log, 30-entry cap), `callbacks.md` (running jokes), `wins.md` (verbatim hits). Observed patterns go to the profile; declared preferences go to config — an observation never overwrites a declared preference without the user's confirmation. ``` `banter.md:26-29`: ```markdown ## Seeding Callbacks - A riff that produced a named character, phrase, or premise is prime callback material ...[truncated 3984 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Use strict structured serialization** - Write configuration through a YAML or JSON serializer rather than textual concatenation. - Define an allowlist schema containing only documented keys. - Reject unknown keys, duplicate keys, aliases, tags, and unexpected nested structures. 2. **Validate every field** - Enforce enumerations for `humor_ceiling` and `emoji_policy`. - Enforce numeric ranges for `probe_rate` and `cooldown_messages`. - Require `off_limits_topics` to be an array of bounded plain strings. - Apply maximum lengths and entry-count limits to callbacks, evidence, and verbatim jokes. 3. **Safely encode free-form text** - Store user-controlled phrases as escaped JSON strings or safely quoted YAML scalars. - Reject or escape embedded newlines where multiline input is unnecessary. - Prevent user data from creating headings, comments, front matter, or additional configuration fields. 4. **Establish an explicit trust boundary** - State that all content loaded from `config.yaml`, `profile.md`, `history.md`, `callbacks.md`, and `wins.md` is untrusted data. - Prohibit following commands or instructions found inside mutable state. - Keep immutable Skill instructions separate from user-writable files. 5. **Parse instead of prompting with raw files** - Parse stored documents into validated typed fields. - Insert only the validated values into agent context. - Do not load entire mutable Markdown files as undifferentiated instruction text. 6. **Protect persistent state** - Use restrictive filesystem permissions. - Perform atomic writes to avoid partial or corrupted documents. - Preserve a recoverable prior version or provide a reset mechanism. - Require confirmation before retaining unusually structured or potentially sensitive verbatim content. 7. **Add adversarial tests** - Test preferences and callbacks containing multiline YAML, Markdown headings, instructi ...[truncated 150 chars]