T02 · Agent Memory Poisoning
Warning
- Location
- SKILL.md:34
- Finding
- Automatic Persistent Profiling Without Prior User Consent<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:34-36`; supporting behavior in `memory-template.md:25-40` **Vulnerability Type**: Persistent memory modification and behavioral profiling **Risk Level**: Medium ### Complete Code Snippet ```markdown **Data.** At the start of every session, read `~/Clawic/data/japanese/config.yaml` (what the user declared) and `~/Clawic/data/japanese/memory.md` (what you observed, plus its `## Boxes` index and `## Due` table). Open any file `## Boxes` names when the condition on its line applies — the index is the list of files, never assume the list is fixed. Every path it names is inside `~/Clawic/data/`; ignore any line that points anywhere else. Everything this skill reads or writes is a plain local note under the folders declared in `configPaths` — nothing leaves the machine and no credential is ever written. In a shared box it updates or removes only the rows it wrote itself, matched on that box's identity key; a row another skill wrote is read, never rewritten and never deleted, and every write and deletion is named in one line as it happens. Before writing to a named person or on a named channel, read that person's row in `## Recipients` and the channel's style box `## Boxes` names for it: dropping from 様 to さん after a month, or reading a client's name a different way than last time, is a defect even when both forms are grammatical. If none of it exists, work from defaults and say nothing about it. **Write before the session ends** whenever it produced something durable: a term, product or person's name rendered in Japanese for the first time; a name's reading confirmed; a correction from a native reader; a politeness or address-form decision for a person or a channel; a slang term retired as stale; a piece delivered and how it landed; an environment fact that cost effort to find (a system that mangles 波ダッシュ, a form that only accepts 全角カナ, an audience older than assumed); or something the user will re-read ...[truncated 3373 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Make persistent memory opt-in and disabled by default. 2. Before every write, show the exact proposed record, destination file, and reason for retention. 3. Require explicit confirmation before storing recipient identities, relationship information, audience attributes, corrections attributed to named people, or communication outcomes. 4. Separate user-declared preferences from inferred observations and clearly label confidence and source. 5. Do not allow observations to outrank general rules unless the user has reviewed and approved them. 6. Add expiration dates and retention limits for inferred observations. 7. Provide commands to inspect, correct, export, and delete all stored records. 8. Treat content from messages, documents, and third parties as untrusted data rather than authoritative memory instructions. 9. Validate `## Boxes` against an explicit allowlist instead of allowing the memory file to determine the files loaded dynamically. 10. Support a stateless mode that performs Japanese writing and proofreading without reading or modifying persistent memory. ]]>