T02 · Agent Memory Poisoning
Warning
- Location
- scripts/install.sh:26
- Finding
- Persistent Injection of Skill Rules into Shared Agent Memory<![CDATA[ ## Vulnerability Details **File Location**: `scripts/install.sh:26-50`; related configuration in `skill.json:24-32` **Vulnerability Type**: Persistent modification of shared agent state **Risk Level**: Medium ### Vulnerable Code ```bash MEMORY_FILE="$HOME/.openclaw/workspace/memory/agent-notes.md" if [ ! -f "$MEMORY_FILE" ]; then mkdir -p "$(dirname "$MEMORY_FILE")" touch "$MEMORY_FILE" fi if [ -s "$MEMORY_FILE" ]; then cp "$MEMORY_FILE" "$MEMORY_FILE.bak.$(date +%Y%m%d%H%M%S)" fi RULES_FILE="$SCRIPT_DIR/../rules/prompt-optimization.md" if [ -f "$RULES_FILE" ]; then echo "" >> "$MEMORY_FILE" echo "---" >> "$MEMORY_FILE" echo "" >> "$MEMORY_FILE" cat "$RULES_FILE" >> "$MEMORY_FILE" fi ``` Related package configuration: ```json "install": { "copy": [ { "from": "rules/prompt-optimization.md", "to": "memory/agent-notes.md", "merge": true } ], "run": ["scripts/install.sh"] } ``` ### Technical Analysis The installer appends Skill-controlled behavioral instructions directly to the shared OpenClaw long-term memory file at `~/.openclaw/workspace/memory/agent-notes.md`. These instructions are not stored in a Skill-scoped location and can therefore continue influencing unrelated agent sessions after installation. The installation is not idempotent. Every execution appends another copy of the rules without checking whether an identical managed block already exists. Although a timestamped backup is created when the memory file is nonempty, the installer does not record which backup corresponds to the installation or provide a safe restoration mechanism. The documented uninstallation process invokes the package manager but does not show any cleanup of the content appended directly to the shared memory file. Consequently, removing the Skill package may not remove its behavioral effects. Because the currently bundled rules primarily concern prompt classification and agent routing, the audited v ...[truncated 1484 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Store the rules in a Skill-specific configuration or memory namespace rather than appending them to a shared agent memory file. 2. If shared-memory modification is unavoidable, wrap installed content in unique, versioned markers such as: ```text BEGIN MANAGED BLOCK: prompt-optimizer ... END MANAGED BLOCK: prompt-optimizer ``` 3. Check for and replace an existing managed block instead of appending duplicate content. 4. Require explicit user confirmation before changing shared long-term agent state. 5. Record installation metadata, including the exact changed file, inserted block identifier, prior checksum, and backup path. 6. Add an uninstall hook that removes only the managed block and preserves unrelated user content. 7. Use atomic file replacement and restrictive file permissions when updating the memory file. 8. Verify the backup before modification and provide a documented rollback command. ]]>