T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:72- Finding
Persistent modification of Agent instructions and memory state
- Content
View full analysis
/scripts/obsidian-search.js 2. Search local memory for the most recent three days. 3. Merge both results, prioritizing knowledge from the Vault. ### Write mechanism After a task is completed, write to both locations: 1. Obsidian Vault 2. Local memory: memory/YYYY-MM-DD.md, and update the MEMORY.md index ### Step 6: Simplify MEMORY.md Replace MEMORY.md with a lightweight index referring to the Obsidian Vault. ``` ### Technical Analysis The Skill instructs the Agent to append to or replace persistent instructions in `AGENTS.md` and to rewrite `MEMORY.md`. These files affect behavior beyond the current invocation, including when retrieval occurs, which source is prioritized, and where future conversation-derived information is stored. Separating ordinary Skill configuration from trusted Agent policy is an important security boundary. Automatically placing Skill-controlled rules in persistent Agent instruction or memory files allows those rules to remain active in later sessions. The instruction to prioritize Vault content further increases the effect of any incorrect or attacker-controlled information stored there. ### Attack Path 1. A user activates the Skill to initialize an Obsidian memory system. 2. The Agent follows the initialization instructions and modifies `AGENTS.md` and `MEMORY.md`. 3. The new instructions remain present after the initialization session ends. 4. Future sessions automatically search the Vault, prioritize its c ...[truncated 767 chars]- Remediation
View remediation