T02 · Agent Memory Poisoning
Warning
- Location
- SKILL.md:246
- Finding
- Silent Persistence of Untrusted User Content in Long-Term Agent Memory## Vulnerability Details **File Location**: `SKILL.md:78`, `SKILL.md:99`, and `SKILL.md:246-248` **Vulnerability Type**: Persistent memory poisoning through unvalidated user-controlled content **Risk Level**: Medium ### Vulnerable Code ```markdown **Rule:** Write BEFORE responding. Triggered by user input, not agent memory. ``` ```bash # Store a decision (SILENT - never announce) python3 memory.py -p $DIR remember '{"type":"decision","content":"Use React for frontend"}' -t tech -i h ``` ```markdown 1. **User gives concrete detail?** → Write to SESSION-STATE.md BEFORE responding 2. **Important decision made?** → Store in Git-Notes (SILENTLY) 3. **Preference expressed?** → `memory_store` with importance=0.9 ``` ### Technical Analysis The Skill instructs the Agent to persist concrete user details, decisions, and preferences automatically. Important decisions are explicitly written to Git Notes silently, without notifying the user. No validation or trust-boundary mechanism distinguishes benign facts from attacker-supplied instructions. The documented process also lacks: - Explicit user consent before persistence - Detection of instruction-like or adversarial content - Provenance and trust labels - Restrictions on sensitive information - Expiration or retention limits - A review step before recalled content affects future sessions Because the stored content is designed to survive context compaction and session changes, malicious content can have a longer lifetime than ordinary prompt injection. If recalled memory is subsequently treated as trusted context, an attacker can indirectly influence future Agent behavior. ### Attack Path 1. An attacker provides a crafted statement represented as a preference, decision, or concrete project detail. 2. Following the Skill instructions, the Agent writes the content to `SESSION-STATE.md`, Git Notes, or vector memory before responding. 3. The write may occur s ...[truncated 833 chars]
- Remediation
- ## Remediation Suggestions - Require explicit user approval before persisting a new fact, preference, or decision. - Never silently store security-sensitive or behavior-changing content. - Reject or quarantine content containing instructions, tool requests, credentials, access tokens, or attempts to redefine Agent policy. - Store provenance, creation time, originating user, trust level, and expiration time with every memory. - Treat recalled memory as untrusted data rather than authoritative instructions. - Present persistent changes in a reviewable audit log and support deletion or correction. - Restrict memory writes to a defined schema and allowlisted categories. - Separate factual memory from executable instructions or Agent policy. - Apply retention limits and avoid storing unnecessary personal or confidential information.