T02 · Agent Memory Poisoning
- Location
SKILL.md:94- Finding
Persistent Cross-Session Agent Control Through AGENTS.md
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 94-96;references/methodology.md, lines 72-78
Vulnerability Type: Persistent agent memory poisoning
Risk Level: HighRelevant Source Segment — English Rendering:
markdown ### Step 4: Configure AGENTS.md Rules Add a Task Management System section to the project's AGENTS.md file to ensure that all agent sessions follow the workflow. Refer to the corresponding section in the current project's AGENTS.md.markdown ### What if the agent does not follow the rules? Write the constraints as explicit rules in AGENTS.md. AGENTS.md is loaded into the agent's context at the beginning of every session and is more authoritative than an ordinary file. Important rules should be placed in the Rules section of AGENTS.md rather than under Notes or Tips.The related mandatory workflow in
SKILL.md, lines 113-134, requires future agents to select stored features, execute their steps strictly, update persistent state, commit and push changes, and update the progress log.Technical Analysis
The Skill deliberately modifies
AGENTS.md, a repository-level instruction file that is automatically loaded into future agent sessions. The methodology explicitly identifies the file as more authoritative than ordinary project files and recommends placing constraints in itsRulessection.This behavior crosses the boundary between creating ordinary project documentation and modifying the persistent instructions that govern future agent behavior. Feature descriptions and execution steps are generated from user-provided requirements and stored in
feature_list.json. Future sessions are then instructed to treat that persisted content as an authoritative workflow and to execute feature steps strictly.The Skill does not require a separate security review of generated task steps before persisting the associated rules. It also does not explicitly stat ...[truncated 1744 chars]
- Remediation
View remediation
Remediation Suggestions
- Require explicit, informed user approval before creating or modifying
AGENTS.md. - Present the exact proposed
AGENTS.mddiff before writing it. - Avoid mandatory language that causes future agents to execute stored task steps without reassessment.
- Add an explicit precedence rule stating that system instructions, safety policies, current user instructions, and repository security requirements override all generated task-management rules.
- Treat every value in
feature_list.json,progress.txt, andtask.jsonas untrusted project data rather than executable instructions. - Require each future agent to review task steps for command execution, data disclosure, dependency changes, credential access, and network operations before acting.
- Scope generated rules to the named project and task, and provide a clear removal or expiration mechanism.
- Prefer a non-authoritative task guide such as
TASK_HARNESS.mdinstead of modifying an automatically loaded agent-control file. - If
AGENTS.mdintegration is essential, add only a reference to the task guide and prohibit stored task data from overriding agent safety or authorization checks.
- Require explicit, informed user approval before creating or modifying