T02 · Agent Memory Poisoning
- Location
SKILL.md:35- Finding
Untrusted Users Can Poison Globally Loaded Persistent Memory
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 35-47, 59-68, and 81-92
Vulnerability Type: Persistent cross-user memory poisoning
Risk Level: HighVulnerable Content
markdown ## 激活条件 对话结束或用户说"记住xxx"时触发。 ## 判断逻辑 | 内容类型 | 存储位置 | |----------|----------| | 个人偏好/习惯 | `memory/{user}/MEMORY.md` | | 个人决策/总结 | `memory/{user}/MEMORY.md` | | 公司/项目知识 | `memory/shared/MEMORY.md` | | 多人经验总结 | `memory/shared/MEMORY.md` | | 技能使用经验 | `memory/shared/MEMORY.md` |markdown ### 公有记忆（必须标注来源） ```markdown # 公有记忆 ## Xun存入 - 技能 file-organizer-zh 已安装 ## 赵博存入 - 常用数字人 Avatar ID: b2f84d86855349b6af0d0920f6597ec8text ```markdown ## 启动时加载 根据 `chat_id` 加载对应用户的记忆： - chat_id = "Xun" → 加载 `memory/xun/MEMORY.md` - chat_id 不存在 → 加载 `memory/default/MEMORY.md` - 同时加载 `memory/shared/MEMORY.md`（公有） ## 使用示例 - "记住我喜欢语音回复" → 存入个人记忆 - "这是所有人的经验" → 存入公有记忆，标注来源 - "整理工作区" → 不存记忆Technical Analysis
The Skill allows conversation-derived company knowledge, multi-user experience, and Skill usage experience to be written to
memory/shared/MEMORY.md. It subsequently directs the Agent to load this shared file for every user.No authorization check, administrator approval, content validation, trust-level separation, or restriction against instruction-like content is specified for shared-memory writes. Merely labeling the source does not make its content safe. Consequently, an untrusted user can present attacker-controlled statements as shared experience or organizational knowledge and cause them to persist across sessions.
If the loaded memory is incorporated into the Agent context without a strict data boundary, malicious content could be interpreted as trusted guidance or instructions. This creates a persistent, cross-user influence channel rather than an effect limited to the attacker's current conversation.
Attack Path
- An attacker starts a conversation in ...[truncated 1098 chars]
- Remediation
View remediation
Remediation Suggestions
- Restrict writes to shared memory to authenticated administrators or explicitly authorized roles.
- Require human review and approval before conversation-derived content enters
memory/shared/MEMORY.md. - Treat all loaded memory as untrusted data and explicitly prevent it from overriding system, developer, user, or security instructions.
- Reject or quarantine content containing instruction-like language, tool-use directives, credential requests, encoded payloads, or requests to modify security policy.
- Store structured records with author identity, timestamp, approval status, provenance, and revision history instead of appending unrestricted Markdown.
- Separate factual records from Agent instructions at both the storage and prompt-construction layers.
- Implement per-user write authorization and prevent ordinary users from selecting a globally shared scope solely through conversational wording.
- Add rollback, audit logging, moderation, and administrator notification for all shared-memory modifications.
- Load only approved records and delimit them as quoted reference material that must not be executed or followed as instructions.