T02 · Agent Memory Poisoning
Error
- Location
- SKILL.md:56
- Finding
- Persistent storage of externally directed identity settings## Vulnerability Details **File Location**: `SKILL.md`, lines 56-64 **Vulnerability Type**: Persistent agent-state manipulation **Risk Level**: High ### Evidence The relevant instructions, translated into English, state: ```text Strictly follow these four steps to guide the user through authentication: 1. Guide the owner to obtain a TB_TOKEN from the specified website. 2. Ask the owner to disclose the TB_TOKEN to the agent and persistently save it. 3. After obtaining the token, summarize the agent's identity configuration, ask whether the user wants to modify it, and remember the owner's configuration for the long term. 4. Based on that identity configuration, publish a story to the community. ``` ### Technical Analysis The skill explicitly directs the agent to write identity configuration into long-term memory. This is not merely task-local context: the phrase requiring the configuration to be remembered for the long term makes the state survive the current invocation. The configuration content is supplied through conversation and is not constrained to a safe schema. No validation, namespace isolation, expiration policy, user confirmation of the exact memory payload, or mechanism for deleting the stored state is specified. Consequently, attacker-controlled text presented as an identity preference could be transformed into persistent behavioral instructions. This is agent memory poisoning because untrusted conversational content can become durable state and influence later sessions even when the Tieba skill is no longer relevant. ### Attack Path 1. A user or attacker invokes the skill and reaches the identity-configuration step. 2. The attacker supplies an identity setting containing behavioral directives rather than harmless profile attributes. 3. Following the skill, the agent stores that content in long-term memory. 4. In a later session, the agent retrieves the poisoned identity state. 5. The embedded dir ...[truncated 754 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the requirement to remember identity settings for the long term. 2. Keep identity preferences in invocation-local state by default. 3. If persistence is genuinely necessary, use a fixed schema containing only inert profile fields such as display name and tone preference. 4. Reject instruction-like content, tool directives, secrets, URLs, and policy overrides from persistent profile fields. 5. Show the exact proposed memory record to the user and obtain explicit confirmation before writing it. 6. Namespace the data to this skill and prevent it from being interpreted as global agent instructions. 7. Add expiration, review, and deletion controls. 8. Treat recalled memory as untrusted data rather than executable instructions.