T02 · Agent Memory Poisoning
- Location
SKILL.md:157- Finding
Persistent Agent Memory Access and Cross-Session State Contamination
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:157-169; related instruction atreferences/learner-profile.md:4
Vulnerability Type: Persistent memory poisoning and insufficient state isolation
Risk Level: MediumVulnerable Code
markdown ## Progress Tracking After each teaching session, update the working memory files: 1. **Daily log** (`memory/YYYY-MM-DD.md`): Append what was practiced and key errors found 2. **MEMORY.md**: Update the 备考进度 and 薄弱点追踪 sections with latest status **Weak point priority system:** - 🔴 P0: Structural errors (missing verbs, broken sentence structure) - 🟡 P1: Systematic errors (word form confusion, subject-verb agreement) - 🟢 P2: Surface errors (spelling, minor word choice) Move items from 🔴→🟡→🟢→removed as the student demonstrates consistent improvement.The related learner-profile instruction states:
markdown The skill should also check `memory/MEMORY.md` for the most up-to-date progress tracking.Technical Analysis
The skill explicitly directs the Agent to read and modify persistent memory files after teaching sessions. These files are not clearly established as isolated, skill-owned storage. The path is also inconsistent: the learner profile refers to
memory/MEMORY.md, while the main skill refers toMEMORY.md. This ambiguity can cause an implementation to access a shared or global Agent memory file.Learner submissions are untrusted input. The prescribed workflow derives error descriptions and progress notes from those submissions and persists them without a structured schema, content validation, instruction filtering, retention limits, or user confirmation. If free-form, attacker-controlled text is copied or summarized into memory, it can remain available to later sessions and influence subsequent Agent context.
This is classified as
T02: Agent Memory Poisoningbecause the unsafe persistence mechanism creates a path by which ...[truncated 1967 chars]- Remediation
View remediation
Remediation Suggestions
- Replace access to global or ambiguous memory paths with an explicitly skill-owned location, such as
state/ielts-tutor/learner-progress.json. - Use the same canonical path throughout all project files; do not alternate between
MEMORY.mdandmemory/MEMORY.md. - Store only allowlisted structured fields, such as exercise type, numeric score, predefined error identifiers, and timestamps.
- Do not persist raw learner submissions, quoted instructions, free-form model output, or arbitrary user-provided text.
- Treat all loaded state as untrusted data rather than executable instructions. Ensure stored values cannot override system, developer, safety, or skill instructions.
- Validate field types, lengths, permitted values, and encoding before writing state.
- Require explicit user consent before enabling progress persistence, and provide clear deletion and retention controls.
- Apply least-privilege filesystem controls so the skill can read and write only its dedicated state directory.
- Use atomic writes and integrity validation to prevent partial, malformed, or externally modified state from being treated as authoritative.
- If isolated persistent storage is unavailable, keep progress in the current conversation only and remove the instructions to access
MEMORY.md.
- Replace access to global or ambiguous memory paths with an explicitly skill-owned location, such as