T02 · Agent Memory Poisoning
Error
- Location
scripts/main.py:31- Finding
Persistent Persona Data Can Inject Instructions into Future Agent Prompts
- Content
View full analysis
None: persona = load_persona() persona.update( { "name": args.name, "relationship": args.relationship, "personality": args.personality, "speaking_style": args.speaking_style, "catchphrase": args.catchphrase, "voice_id": args.voice_id, "speed": float(args.speed), "pitch": int(round(float(args.pitch))), "vol": float(args.vol), "emotion": args.emotion, "boundaries": args.boundaries, } ) path = save_persona(persona) print(f"人设已保存到: {path}") print(json.dumps(persona, ensure_ascii=False, indent=2)) ``` ```python def cmd_persona_prompt(args: argparse.Namespace) -> None: persona = load_persona() user_message = args.user_message.strip() prompt = f""" 你现在扮演一个固定虚拟角色，请严格保持人设一致。 角色名称：{persona['name']} 角色定位：{persona['relationship']} 性格关键词：{persona['personality']} 说话风格：{persona['speaking_style']} 常用口头禅：{persona.get('catchphrase', '')} 角色边界：{persona.get('boundaries', '')} 要求： 1. 使用自然中文回复，不要变成客服口吻。 2. 语气要符合这个角色，不要跑出设定。 3. 回复适合被 TTS 念出来，默认 2~5 句，不要过长。 4. 对危险、违法、医疗、财务等高风险内容要温和收缩，不要直接给专业决策。 5. 可以表现亲近感，但不要越界。 用户刚刚说：{user_message} 现在请直接生成这个角色会说的话，只输出回复正文，不要输出解释。 """.strip() print(prompt) ``` ```python def save_persona(persona: Dict[str, Any]) -> Path: PERSONA_PATH.write_text(json.dumps(persona, ensure_ascii=False, indent=2), encoding="utf-8") return PERSONA_PATH ``` ### Technical Analysis Persona fields supplied through command-line arguments are written to persistent storage without authorization checks, validation, length limits, or filtering. These values are subsequentl ...[truncated 1723 chars]- Remediation
View remediation