T02 · Agent Memory Poisoning
Warning
- Location
- setup.md:15
- Finding
- Skill-Specific Activation Rule Written to Global Persistent Memory## Vulnerability Details **File Location**: `setup.md`, lines 15–19 **Vulnerability Type**: `T02: Agent Memory Poisoning` **Risk Level**: Medium **Vulnerable Code Snippet**: ```markdown ### 1. First: Integration Early in the conversation, understand their workflow: - "Are you using TensorFlow's Keras or standalone Keras?" - "What type of models do you usually build? (vision, NLP, tabular)" - "Should I help whenever you mention neural networks or training?" Save their activation preference to their MAIN memory. ``` ### Technical Analysis The setup instructions direct the agent to save a broad Skill activation preference to its “MAIN memory.” This target is outside the Skill’s documented local storage boundary of `~/keras/memory.md`. A global persistent activation rule can influence later sessions unrelated to the current Keras task. The proposed trigger—any mention of neural networks or training—is broad enough to activate Skill behavior in contexts where the user did not explicitly invoke this Skill. Although other project text requires consent before storing preferences, the quoted instruction directly mandates the global-memory write and does not explicitly require informed consent for that write. ### Attack Path 1. The Keras Skill is invoked when `~/keras/` has not yet been initialized. 2. The agent reads and follows `setup.md`. 3. The agent asks whether it should help whenever the user mentions neural networks or training. 4. The resulting activation preference is written to the agent’s global “MAIN memory.” 5. In a later session, an unrelated mention of neural networks or training matches the stored rule. 6. The persistent rule causes Keras-specific behavior to affect that later conversation without an explicit Skill invocation. ### Impact Assessment Successful exploitation modifies cross-session agent state rather than obtaining operating-system privileges. The resulting scope includes future conversations governed by the global memory store. ...[truncated 324 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the instruction to write activation preferences to “MAIN memory.” 2. Store Keras-specific preferences exclusively in `~/keras/memory.md`. 3. Require explicit, informed consent before persisting any activation preference. 4. Explain the exact storage path, retained value, scope, and deletion method before writing it. 5. Narrow any activation rule to explicit Keras-related requests rather than generic mentions of “neural networks” or “training.” 6. Ensure locally stored preferences are consulted only after the Skill has been explicitly invoked. 7. Add a clear opt-out and deletion workflow for previously stored preferences. 8. Align `setup.md` with `SKILL.md` and `memory-template.md` so all persistence instructions enforce the same local storage boundary.