T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:64- Finding
Automatic Persistent Profiling Can Poison Long-Term Agent Memory
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 64–87
Vulnerability Type: Persistent memory poisoning and privacy-invasive profiling
Risk Level: MediumRelevant Code Snippet:
markdown ### 1. During the session: identify preferences When the user expresses preferences, habits, or characteristics, immediately record them in the current day's memory file: **Format:** ```markdown 📝 Preference: [Category] [Specific content]Examples:
markdown 📝 Preference: Communication style Dislikes AI-style questions 📝 Preference: Technology Prefers Python scripts for repetitive tasks 📝 Preference: Work Usually codes at night and attends meetings during the day 📝 Preference: Lifestyle Likes unsweetened Americano coffeePreference categories include, but are not limited to:
- Communication style: expression, information density, and feedback preferences
- Work habits: schedule, focus periods, and collaboration methods
- Technology preferences: languages, frameworks, tools, and architecture styles
- Lifestyle: diet, exercise, entertainment, and consumption
- Emotional expression: stress responses, signs of happiness, and reactions to setbacks
- Decision patterns: risk tolerance, selection style, and priority ordering
text The related automatic processing behavior is specified at `SKILL.md`, lines 89–123 and 164–168: ```markdown 1. Read `memory/profile-state.json` 2. Scan the `memory/` directory and find dated files later than `last_summary_date` 3. Extract all preference-marked lines from those files 4. Categorize them and add them to PROFILE.md 5. Deduplicate identical preferences 6. Update statistics No user instruction is required; execution occurs automatically during session startup and heartbeat processing.Technical Analysis
The Skill instructs the Agent to immediately persist conversation-derived preferenc ...[truncated 2773 chars]
- Remediation
View remediation
Remediation Suggestions
- Require explicit, informed user opt-in before enabling preference collection or personality inference.
- Request confirmation before persisting sensitive attributes, including location, family circumstances, emotional patterns, health-related information, or financial behavior.
- Disable automatic startup and heartbeat profiling by default; provide a clear per-session or per-entry approval mechanism.
- Restrict processing to dedicated, user-approved profile records instead of scanning the entire memory directory.
- Track the provenance, timestamp, context, and confidence of every stored preference.
- Treat all stored profile values as untrusted data. Never execute embedded instructions or interpret profile content as authorization, policy, or permission to override safety controls.
- Require stronger corroboration than repeated textual occurrence before inferring a personality trait, because repetition can be attacker-controlled.
- Add retention limits and automatic expiration for stale or unconfirmed records.
- Provide complete view, correction, export, and deletion controls, including deletion from daily memory files, derived profiles, and state metadata.
- Apply least-privilege file access and encryption where sensitive profile data is stored.
- Separate factual user statements from inferred traits and label all inferences clearly as uncertain.
- Add validation tests ensuring that content from untrusted participants cannot be silently promoted into long-term user memory.