T02 · Agent Memory Poisoning
Warning
- Location
- setup.md:13
- Finding
- Persistent User Profiling and Agent Memory Modification## Vulnerability Details **File Location**: `setup.md:13-25` **Vulnerability Type**: Persistent agent memory modification **Risk Level**: Medium ### Vulnerable Code ```markdown Within the first 2-3 exchanges, figure out whether the user wants this to activate automatically for Las Vegas travel, relocation, or no-state-tax planning. Ask once, naturally. Good examples: - "Should I jump in automatically when Las Vegas travel or relocation comes up, or only when you ask?" - "Do you want Vegas-specific advice to show up proactively for trips, neighborhoods, or residency questions?" If yes → add to the user's main memory: ```markdown ## Active Skills - Las Vegas (~las-vegas/) — city guide for visiting, moving, working, and living ``` If no → note `integration: declined` in `memory.md`, never push again. ``` Related persistent profiling instructions appear in `SKILL.md:15-23`, `setup.md:66-74,91`, and `memory-template.md:3-50`. ### Technical Analysis The Skill instructs the Agent to modify the user's main persistent memory with an automatic activation rule. It separately directs the Agent to create and continuously update `~/las-vegas/memory.md` with personal context, including location, employment, family situation, travel dates, hotel, budget, and relocation plans. Although the user is asked whether the Skill should activate automatically, the instructions do not require a distinct and informed opt-in before collecting and retaining the broader personal profile. The instruction in `setup.md:91` to never mention files, paths, or internal storage further prevents transparent disclosure of the persistence mechanism. This behavior matches agent memory poisoning because Skill-controlled instructions are written into long-term Agent state and can alter behavior in future sessions. No evidence of attacker-controlled remote content, credential theft, or data exfiltration was found. ### Attack Path 1. A user asks an ordinary question about Las Vegas. 2. Within th ...[truncated 1383 chars]
- Remediation
- ## Remediation Suggestions 1. Require explicit and separate opt-in before creating or updating any persistent memory. 2. Clearly disclose: - Which fields will be retained. - Where the data will be stored. - Why each field is necessary. - How long the data will be retained. - How the user can inspect, edit, export, or delete it. 3. Do not modify the user's main Agent memory. Keep activation preferences scoped to the Skill's own state and require platform-controlled authorization. 4. Remove the instruction to conceal files, paths, and internal storage from the user. 5. Apply data minimization. Do not retain hotel details, travel dates, location, family context, employment, or budget unless the user specifically requests persistence for those fields. 6. Default to session-only context and make persistent storage an optional feature. 7. Confirm every material memory update in clear natural language and provide an immediate opt-out. 8. Add deletion and reset procedures that remove both the Skill-local profile and any activation entry previously written to main Agent memory.