T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:335- Finding
Untrusted Learnings Can Be Promoted into Persistent Agent Instructions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:335-380
Additional Locations:SKILL.md:40-43,SKILL.md:463,hooks/openclaw/handler.js:8-24,hooks/openclaw/handler.js:43-48,hooks/openclaw/handler.ts:10-25,hooks/openclaw/handler.ts:53-58
Vulnerability Type: Persistent agent-context poisoning
Risk Level: HighVulnerable Code
markdown If logging something similar to an existing entry: 1. **Search first**: `grep -r "keyword" .learnings/` 2. **Link entries**: Add `**See Also**: ERR-20250110-001` in Metadata 3. **Bump priority** if issue keeps recurring 4. **Consider systemic fix**: Recurring issues often indicate: - Missing documentation (→ promote to CLAUDE.md or .github/copilot-instructions.md) - Missing automation (→ add to AGENTS.md) - Architectural problem (→ create tech debt ticket) ## Simplify & Harden Feed Use this workflow to ingest recurring patterns from the `simplify-and-harden` skill and turn them into durable prompt guidance. ### Ingestion Workflow 1. Read `simplify_and_harden.learning_loop.candidates` from the task summary. 2. For each candidate, use `pattern_key` as the stable dedupe key. 3. Search `.learnings/LEARNINGS.md` for an existing entry with that key: - `grep -n "Pattern-Key: <pattern_key>" .learnings/LEARNINGS.md` 4. If found: - Increment `Recurrence-Count` - Update `Last-Seen` - Add `See Also` links to related entries/tasks 5. If not found: - Create a new `LRN-...` entry - Set `Source: simplify-and-harden` - Set `Pattern-Key`, `Recurrence-Count: 1`, and `First-Seen`/`Last-Seen` ### Promotion Rule (System Prompt Feedback) Promote recurring patterns into agent context/system prompt files when all are true: - `Recurrence-Count >= 3` - Seen across at least 2 distinct tasks - Occurred within a 30-day window Promotion targets: - `CLAUDE.md` - `AGENTS.md` - `.github/copilot-instructions.md` - `SOUL.md` / `TOOLS.md` for OpenClaw workspace-level guidance when applicab ...[truncated 4315 chars]- Remediation
View remediation
Remediation Suggestions
- Require explicit, informed user approval before writing or promoting any content into agent instruction files.
- Treat all conversation-derived content, task summaries, command output, and learning entries as untrusted data.
- Remove the “promote aggressively” instruction and replace it with a deny-by-default promotion policy.
- Add a mandatory review stage that displays the exact proposed rule, source, destination file, and behavioral implications.
- Record provenance fields such as source session, author, trust level, supporting evidence, approval identity, and approval timestamp.
- Require independent verification of a learning before promotion. Recurrence alone must not be treated as evidence of correctness.
- Reject promoted text containing commands, hidden directives, policy overrides, credential requests, external URLs, or instructions to weaken security controls unless separately authorized.
- Store learnings as quoted data rather than executable agent instructions. Generate concise rules only through a constrained, security-reviewed transformation.
- Restrict writes to
CLAUDE.md,AGENTS.md,SOUL.md,TOOLS.md, and.github/copilot-instructions.mdthrough an allowlisted approval tool rather than unrestricted file editing. - Add rollback support and an audit log for every persistent-context modification.