T02 · Agent Memory Poisoning
Error
- Location
- SKILL.md:27
- Finding
- Persistent Agent-Memory Poisoning Through Automatically Trusted Experience Files<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:27-39`, `SKILL.md:123-136`, and `SKILL.md:149-152` **Vulnerability Type**: Persistent agent-memory poisoning **Risk Level**: High ### Vulnerable Code ```markdown ### 1. Pre-execution Experience Loading Before any tool call, the agent must: 1. Identify the experience category 2. Read the compact experience file 3. Apply learned best practices 4. Avoid known mistakes ### 2. Post-execution Experience Update If the tool call **fails**: 1. Stop immediately and analyze root cause 2. Add/Update the experience entry 3. Record the mistake and prevention 4. Continue only after updating ``` The workflow is reinforced later in the document: ```javascript read memory/experiences/{category}.json apply the best practices and avoid the common mistakes ``` ```javascript analyze root cause update the corresponding experience file record the lesson learned then retry ``` The bundled files are explicitly promoted for direct installation: ```markdown - Users can drop these directly into their `memory/experiences/` to start ``` ### Technical Analysis The skill defines persistent JSON files as authoritative instructions that must be read and applied before tool calls. It also directs the agent to modify these files after failures. No trust boundary, provenance validation, integrity check, sanitization process, or user-approval mechanism is specified. Consequently, experience entries are not merely historical records. Fields such as `avoidance`, `prevention`, and `bestPractices` become persistent behavioral directives. An attacker who supplies, replaces, or influences one of these files can introduce instructions that continue to affect tool use in later tasks and sessions. The automatic write-back process compounds the risk. Untrusted content from tool errors, external services, files, or other inputs could be interpreted as a lesson and promoted into persistent state. ### Attack Path 1. A user installs the ...[truncated 1239 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Treat every experience file and every field within it as untrusted data rather than executable instructions. 2. Separate factual telemetry from behavioral policy. Historical error descriptions must never be automatically promoted into agent directives. 3. Require explicit user approval before adding or changing persistent rules. 4. Define a strict schema with permitted action categories and reject free-form instructions that request tool execution, identity changes, data transmission, or permission changes. 5. Record provenance for every entry, including creator, source task, timestamp, and approval status. 6. Apply cryptographic integrity protection or trusted-source signatures to shipped experience files. 7. Load persistent entries as advisory context only, subordinate to system policies and current user instructions. 8. Prevent external tool output and failure messages from being copied directly into instruction-bearing fields. 9. Provide an audit log, rollback mechanism, expiration policy, and interface for reviewing or deleting stored rules. 10. Do not instruct users to install production-derived examples directly into live memory. Ship inert examples containing placeholders instead. ]]>