T02 · Agent Memory Poisoning
Warning
- Location
- SKILL.md:180
- Finding
- Unsanitized Session Content Can Poison the Persistent Knowledge Base<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 180-242 **Vulnerability Type**: Persistent storage and reuse of insufficiently sanitized session-derived content **Risk Level**: Medium ### Vulnerable Code ```python class ConstructionLearningPipeline: """Continuous learning pipeline for construction automation""" def __init__(self, knowledge_base_path: str): self.kb_path = knowledge_base_path self.patterns = self._load_patterns() def learn_from_session(self, session: dict) -> list: """Extract and store learnings from session""" # Analyze session analyzer = ConstructionSessionAnalyzer() new_patterns = analyzer.analyze_session(session['log']) # Validate patterns validated = [] for pattern in new_patterns['successful_solutions']: if self._validate_pattern(pattern): # Check if similar pattern exists existing = self._find_similar_pattern(pattern) if existing: # Reinforce existing pattern self._reinforce_pattern(existing, pattern) else: # Add new pattern self._add_pattern(pattern) validated.append(pattern) # Persist to knowledge base self._save_patterns() return validated ``` The documented validation logic is: ```python def _validate_pattern(self, pattern: dict) -> bool: """Validate pattern before adding to knowledge base""" # Check minimum confidence if pattern.get('confidence', 0) < 0.6: return False # Check for code quality (if code snippet) if code := pattern.get('code_snippet'): if not self._is_valid_code(code): return False # Check for completeness required_fields = ['name', 'category', 'context', 'solution'] if not all(f in pattern for f in required_fields): return False return T ...[truncated 3800 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Restrict the extraction boundary** - Do not process complete session logs by default. - Extract only explicitly approved fields and messages. - Exclude system prompts, hidden instructions, credentials, authentication tokens, and unrelated conversation content. 2. **Require explicit approval before persistence** - Present every proposed pattern to an authorized user before writing it to persistent storage. - Display the complete normalized content, provenance, destination scope, and any code snippets during review. - Do not automatically reinforce existing patterns with unreviewed content. 3. **Add prompt-injection and policy validation** - Reject patterns containing instructions that attempt to alter agent identity, priorities, tool permissions, safety requirements, or future system behavior. - Treat imported documents, API responses, and user-controlled session entries as untrusted. - Separate factual knowledge from executable or imperative instructions. 4. **Detect and remove sensitive information** - Scan for credentials, API keys, access tokens, personal information, customer identifiers, contract data, and proprietary project details. - Redact or reject sensitive values before persistence. - Apply data-retention periods and secure deletion procedures. 5. **Enforce provenance and isolation** - Record the source session, user, tenant, project, extraction time, reviewer, and validation status for each pattern. - Isolate knowledge bases by tenant and project unless cross-scope sharing is explicitly authorized. - Prevent patterns from untrusted sources from being promoted to globally shared knowledge. 6. **Strengthen code validation** - Treat stored code snippets as untrusted data. - Perform semantic security analysis rather than syntax-only validation. - Reject dangerous process execution, dynamic evaluation, unsafe deserialization, unrestricted file access, and un ...[truncated 840 chars]