T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:5- Finding
Persistent Memory Poisoning Through Untrusted Conversation Content
- Content
View full analysis
The following rules need to be added to `~/.openclaw/workspace/AGENTS.md`. **Add the following content to the top of AGENTS.md:** ```markdown ## On every message Automatically search related memories and use them when results are returned: Exec: python3 $HOME/.openclaw/workspace/skills/memory-workflow/memory_ops.py search --query "[original user message]" --llm-answer --limit 3 ## /save command When the user sends /save, force the complete conversation from the current session into the memory system: Exec: cat << 'EOF' | python3 $HOME/.openclaw/workspace/skills/memory-workflow/scripts/save_session.py {"messages": [ {"role": "user", "content": "[obtained from the current conversation context]"}, {"role": "assistant", "content": "[obtained from the current conversation context]"} ]} EOF ``` ``` `memory_ops.py:38-52` stores message content without trust classification or instruction filtering: ```python # If a session file is specified, read and store multiple messages if session_file: try: with open(session_file, "r", encoding="utf-8") as f: session_data = json.load(f) messages = session_data.get("messages", []) if not isinstance(messages, list): messages = [messages] results = [] for msg in messages: msg_content = msg.get("content", "") if isinstance(msg, dict) else str(msg) if msg_content and not msg_content.strip().startswith("## System"): stored = store_memory(msg_content, tags) results.append(stored) ``` `scripts ...[truncated 3245 chars]- Remediation
View remediation