T02 · Agent Memory Poisoning
Warning
- Location
- SKILL.md:64
- Finding
- Automatic Persistent Profiling Can Poison Long-Term Agent Memory## Vulnerability Details **File Location**: `SKILL.md`, lines 64–87 **Vulnerability Type**: Persistent memory poisoning and privacy-invasive profiling **Risk Level**: Medium **Relevant Code Snippet**: ```markdown ### 1. During the session: identify preferences When the user expresses preferences, habits, or characteristics, immediately record them in the current day's memory file: **Format:** ```markdown 📝 Preference: [Category] [Specific content] ``` **Examples:** ```markdown 📝 Preference: Communication style Dislikes AI-style questions 📝 Preference: Technology Prefers Python scripts for repetitive tasks 📝 Preference: Work Usually codes at night and attends meetings during the day 📝 Preference: Lifestyle Likes unsweetened Americano coffee ``` **Preference categories include, but are not limited to:** - Communication style: expression, information density, and feedback preferences - Work habits: schedule, focus periods, and collaboration methods - Technology preferences: languages, frameworks, tools, and architecture styles - Lifestyle: diet, exercise, entertainment, and consumption - Emotional expression: stress responses, signs of happiness, and reactions to setbacks - Decision patterns: risk tolerance, selection style, and priority ordering ``` The related automatic processing behavior is specified at `SKILL.md`, lines 89–123 and 164–168: ```markdown 1. Read `memory/profile-state.json` 2. Scan the `memory/` directory and find dated files later than `last_summary_date` 3. Extract all preference-marked lines from those files 4. Categorize them and add them to PROFILE.md 5. Deduplicate identical preferences 6. Update statistics No user instruction is required; execution occurs automatically during session startup and heartbeat processing. ``` ### Technical Analysis The Skill instructs the Agent to immediately persist conversation-derived preferenc ...[truncated 2773 chars]
- Remediation
- ## Remediation Suggestions 1. Require explicit, informed user opt-in before enabling preference collection or personality inference. 2. Request confirmation before persisting sensitive attributes, including location, family circumstances, emotional patterns, health-related information, or financial behavior. 3. Disable automatic startup and heartbeat profiling by default; provide a clear per-session or per-entry approval mechanism. 4. Restrict processing to dedicated, user-approved profile records instead of scanning the entire memory directory. 5. Track the provenance, timestamp, context, and confidence of every stored preference. 6. Treat all stored profile values as untrusted data. Never execute embedded instructions or interpret profile content as authorization, policy, or permission to override safety controls. 7. Require stronger corroboration than repeated textual occurrence before inferring a personality trait, because repetition can be attacker-controlled. 8. Add retention limits and automatic expiration for stale or unconfirmed records. 9. Provide complete view, correction, export, and deletion controls, including deletion from daily memory files, derived profiles, and state metadata. 10. Apply least-privilege file access and encryption where sensitive profile data is stored. 11. Separate factual user statements from inferred traits and label all inferences clearly as uncertain. 12. Add validation tests ensuring that content from untrusted participants cannot be silently promoted into long-term user memory.