T02 · Agent Memory Poisoning
- Location
hooks/openclaw/handler.ts:45- Finding
Bootstrap Instructions Can Poison Persistent Agent Governance
- Content
View full analysis
Vulnerability Details
File Location:
hooks/openclaw/handler.ts:45-52
Additional Locations:hooks/openclaw/handler.js:44-51,references/phase1-phase2-enhanced-lessons.md:120,references/phase1-phase2-enhanced-lessons.md:303-325,SKILL.md:24-31
Vulnerability Type: Persistent agent memory and governance poisoning
Risk Level: MediumVulnerable Code
typescript ### Tracking Recurring Patterns - Increment \`Recurrence-Count\` when you see same issue again - When count ≥ 3 over 30 days → consider promoting to permanent rule in AGENTS.md ### Promotion Path When a lesson becomes broadly applicable: - **Behavioral patterns** → \`SOUL.md\` - **Workflow improvements** → \`AGENTS.md\` - **Tool gotchas** → \`TOOLS.md\`The injected content is installed into the main agent's bootstrap context by the following handler logic:
typescript if (Array.isArray(event.context.bootstrapFiles)) { event.context.bootstrapFiles.push({ path: 'PI_WORKFLOW_REMINDER.md', content: REMINDER_CONTENT, virtual: true, }); }The associated Skill instructions also mandate persistent lesson capture:
markdown - After ANY correction from the user: update `tasks/lessons.md` with metadata - Write rules for yourself that prevent the same mistake - Review lessons at session start for relevant projects - Track recurring patterns with Recurrence-CountTechnical Analysis
The bootstrap hook injects instructions into each main-agent session directing the agent to record corrections, errors, and observations in persistent workspace files. It further recommends promoting recurring observations into
AGENTS.md,SOUL.md, andTOOLS.md, which can govern behavior across later sessions.The workflow does not require explicit user approval, source-trust validation, sanitization, or provenance review before a lesson is promoted. Consequently, content originating from ...[truncated 2090 chars]
- Remediation
View remediation
Remediation Suggestions
- Require explicit user confirmation before writing to
AGENTS.md,SOUL.md,TOOLS.md,MEMORY.md, or any other persistent governance file. - Treat repository content, external documents, task descriptions, web content, and tool output as untrusted sources that cannot directly create or promote behavioral rules.
- Add provenance metadata to every lesson, including its source, originating session, trust level, related files, and the user who approved it.
- Store automatically captured lessons in a quarantined candidate file rather than an active memory or governance file.
- Require a review step that displays the exact proposed rule, its source evidence, and its expected behavioral impact before promotion.
- Sanitize promoted content by rejecting embedded instructions to override safety constraints, execute commands, expose secrets, modify permissions, or trust external inputs.
- Change mandatory wording such as “After ANY correction” to advisory wording that permits the agent to reject suspicious or task-specific corrections.
- Restrict hook instructions to documentation and reminders; do not instruct the agent to modify persistent governance files automatically.
- Maintain an auditable change history and provide a straightforward rollback mechanism for all promoted rules.
- Keep the hook disabled by default unless the user explicitly opts into persistent self-improvement behavior.
- Require explicit user confirmation before writing to