T02 · Agent Memory Poisoning
Warning
- Location
scripts/install.sh:26- Finding
Persistent Injection of Skill Rules into Shared Agent Memory
- Content
View full analysis
> "$MEMORY_FILE" echo "---" >> "$MEMORY_FILE" echo "" >> "$MEMORY_FILE" cat "$RULES_FILE" >> "$MEMORY_FILE" fi ``` Related package configuration: ```json "install": { "copy": [ { "from": "rules/prompt-optimization.md", "to": "memory/agent-notes.md", "merge": true } ], "run": ["scripts/install.sh"] } ``` ### Technical Analysis The installer appends Skill-controlled behavioral instructions directly to the shared OpenClaw long-term memory file at `~/.openclaw/workspace/memory/agent-notes.md`. These instructions are not stored in a Skill-scoped location and can therefore continue influencing unrelated agent sessions after installation. The installation is not idempotent. Every execution appends another copy of the rules without checking whether an identical managed block already exists. Although a timestamped backup is created when the memory file is nonempty, the installer does not record which backup corresponds to the installation or provide a safe restoration mechanism. The documented uninstallation process invokes the package manager but does not show any cleanup of the content appended directly to the shared memory file. Consequently, removing the Skill package may not remove its behavioral effects. Because the currently bundled rules primarily concern prompt classification and agent routing, the audited v ...[truncated 1484 chars]- Remediation
View remediation