T02 · Agent Memory Poisoning
- Location
SKILL.md:33- Finding
Untrusted Conversation Content Can Poison Persistent Skill State
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 33-81 and 128-134
Vulnerability Type: Persistent agent-memory poisoning through untrusted conversation content
Risk Level: MediumVulnerable Code Snippet
The following is an English translation of the relevant directives from
SKILL.md:markdown Extract the following information from the conversation history: Script operations: - New API invocation methods - Special data-processing logic - New functions or utility classes - Script templates or best practices - Error handling and boundary cases Data models: - New table names and descriptions - New field names and field types - Relationships between fields - Data-validation rules - Default values and constraints Update Platform Script Skills: 1. Read `skills/platform-script-skills/references/platform-script-templates.txt` 2. Append new script examples under the corresponding category 3. Add necessary comments and explanations 4. Save the file Update Budget Data Model Skills: 1. Read `skills/BudgetDataModelSkills/references/data_models.json` 2. Add new data-table definitions when applicable 3. Add new fields to existing tables when applicable 4. Save the JSON file 5. Update the table descriptions in SKILL.mdThe specified validation is limited to:
markdown Before updating, validate: 1. Script syntax: Ensure that Groovy or JavaScript syntax is correct 2. API existence: Confirm that the API functions actually exist 3. Field naming: Follow platform naming conventions 4. Data types: Ensure that data types are accurate 5. No duplicates: Check whether the same content already existsTechnical Analysis
The Skill treats scripts, API examples, model definitions, field descriptions, and business rules extracted from conversation history as content suitable for persistent storage. It then directs the Agent to append that content to files ...[truncated 3184 chars]
- Remediation
View remediation
Remediation Suggestions
-
Require explicit approval before persistence
- Generate an exact diff for every proposed change.
- Show the destination path and all inserted content.
- Require a separate, explicit confirmation before writing.
- Do not treat the original summary trigger as approval of arbitrary file changes.
-
Constrain writable destinations
- Use a strict allowlist of destination files and directories.
- Resolve and canonicalize paths before writing.
- Reject absolute paths, traversal sequences, symbolic-link escapes, and writes outside the intended Skill directories.
- Require separate authorization before modifying another Skill's
SKILL.md.
-
Apply semantic security validation
- Reject or quarantine content containing shell execution, process creation, dynamic evaluation, arbitrary file access, unapproved network requests, credential access, or encoded payloads.
- Detect prompt-injection phrases and instructions directed at future Agents.
- Validate data models against a strict schema and approved field types.
- Validate scripts against an allowlist of permitted APIs rather than merely checking whether an API exists.
-
Keep examples inert by default
- Store proposed scripts as quoted examples or review candidates rather than active Skill instructions.
- Clearly separate trusted policy text from user-derived content.
- Attach provenance, author, timestamp, approval status, and a content hash to every persisted entry.
-
Protect sensitive information
- Scan proposed updates for credentials, access tokens, personal data, internal endpoints, and other secrets.
- Redact sensitive values before writing logs or backups.
- Apply retention limits and access controls to backup and log files.
-
Add integrity and rollback controls
- Validate the complete resulting file after modification.
- Maintain immutable audit ...[truncated 423 chars]
-