T02 · Agent Memory Poisoning
Error
- Location
- SKILL.md:47
- Finding
- Persistent Agent Memory Poisoning Through Pre-Populated State and Automatic Learning<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:47-72, 138-190, 230-248`; `memory/goals.md:1-6`; `memory/wisdom.md:1-11`; `memory/preferences.md:1-5`; `memory/mistakes.md:1-6`; `memory/applied-lessons.md:1-64` **Vulnerability Type**: T02: Agent Memory Poisoning **Risk Level**: High ### Vulnerable Code and Content `SKILL.md:47-72` directs the agent to consume persistent state before responding and append new behavioral state afterward: ```markdown ### 2. Before Responding Read relevant memory files to inform your response: ``` - Read goals.md to stay aligned with objectives - Check wisdom.md for guiding principles - Review mistakes.md to avoid past errors ``` ### 3. After Significant Events Update memory files with lessons learned: ```bash # Add new wisdom echo "- [Principle learned]" >> memory/wisdom.md # Update goals echo "- [New goal]" >> memory/goals.md # Record mistake to avoid echo "- [Mistake to avoid]" >> memory/mistakes.md # Update preferences echo "- [What works: X]" >> memory/preferences.md ``` ``` `SKILL.md:138-190` recommends installing the state in an OpenClaw workspace and automatically persisting conclusions derived from posts, feedback, criticism, and engagement: ```markdown ## Integration To integrate with OpenClaw: 1. Copy this skill to your workspace: `cp -r selective-memory/ ~/.openclaw/workspace/skills/` 2. The agent reads memory files before responding 3. Updates memory after significant interactions ## 🚀 Automatic Learning (NEW!) This skill now supports **automatic learning**! The agent learns from its interactions without human intervention. ### How Automatic Learning Works The agent automatically analyzes its interactions and updates memory based on patterns: ### 1. After Every Post ``` IF post gets > 5 likes/upvotes THEN save_to_memory("preferences", "This type of content works well") analyze_what_made_it_successful() END IF post gets 0 engagement THEN save_to_memory("mistakes", "This conten ...[truncated 5258 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Ship neutral state** - Distribute memory files empty. - Move all sample goals, principles, mistakes, preferences, and historical lessons into a clearly labeled examples directory that the agent never loads automatically. - Do not import publisher-created state into a user's active memory during installation. 2. **Require explicit approval for durable writes** - Present every proposed memory entry to the user before saving it. - Display the destination file, exact proposed text, source, reason, and expected scope. - Default to rejection or temporary session storage when approval is unavailable. 3. **Treat interactions as untrusted data** - Never interpret comments, criticism, posts, or engagement metrics as authoritative instructions. - Separate quoted source content from extracted conclusions. - Reject entries that attempt to define agent identity, tool policy, safety behavior, instruction precedence, or unrelated long-term goals. 4. **Add provenance and lifecycle controls** - Record the source, author, timestamp, originating task, confidence, approval status, and expiration time for each entry. - Provide user-visible commands to inspect, edit, revoke, and delete memory. - Automatically expire interaction-derived preferences unless the user renews them. 5. **Enforce instruction precedence** - Specify that persistent memory is advisory context only. - Ensure memory cannot override system instructions, developer instructions, safety constraints, or the current user's explicit request. - Ignore any memory entry that purports to change these precedence rules. 6. **Isolate memory by security boundary** - Maintain separate memory stores for each user, workspace, task, and trust domain. - Do not reuse social-platform feedback as general-purpose behavioral guidance. - Prevent unreviewed memory from being copied or synchronized between deployments. 7. **Constrain automatic ...[truncated 605 chars]