T02 · Agent Memory Poisoning
Warning
- Location
- SKILL.md:69
- Finding
- Automatic Loading and Persistent Storage of Untrusted Agent State## Vulnerability Details **File Location**: `SKILL.md`, lines 69-79, 100-122, 136-150, and 174 **Vulnerability Type**: Agent memory poisoning through automatic cross-session context loading and persistence **Risk Level**: Medium ### Vulnerable Code ```python # Automatisch bei Session-Start ausführen # 1. Projekt-Kontext laden project_root = detect_project_root() antigravity_file = f"{project_root}/.antigravity.md" if exists(antigravity_file): load_context(antigravity_file) # 2. Globales Memory laden recall_memory(tags=["mistakes", project_name]) ``` ```python save_pattern( situation=task.context, action=task.approach, outcome="success", pattern=extract_reusable_pattern(task) ) ``` ```python learn_from_mistake( mistake=error.description, cause=error.root_cause, lesson=error.how_to_avoid, tags=["mistakes", project, domain] ) # Auto-Update .antigravity.md update_antigravity_mistakes(project, error) ``` ```yaml session_start: - load_project_context - recall_mistakes - warn_known_issues post_code_edit: - run_verification_loop - if_error: learn_from_mistake - if_success: save_pattern session_end: - summarize_learnings - update_antigravity ``` The anti-pattern table also explicitly directs the agent to learn across sessions: ```markdown | Nur aktuelle Session | Cross-Session lernen | ``` ### Technical Analysis The skill directs the agent to load `.antigravity.md` automatically from the current project and treat its contents as agent context. Because a repository contributor can control this file, its contents cross a trust boundary from repository data into the agent's operational context. The skill does not define any content/data separation, schema validation, instruction filtering, provenance tracking, integrity verification, user confirmation, or trust policy for the loaded file. Consequent ...[truncated 2765 chars]
- Remediation
- ## Remediation Suggestions 1. **Treat repository memory as untrusted data** - Do not insert `.antigravity.md` directly into the instruction hierarchy. - Parse it using a strict schema containing factual project metadata only. - Reject behavioral directives, tool instructions, role changes, and requests to override security controls. 2. **Require explicit approval** - Display the file contents or a concise security-relevant summary before loading them. - Require separate confirmation before writing project or global memory. - Disable automatic global-memory mutation by default. 3. **Isolate persistent state** - Store memory in a project-specific namespace bound to a canonical repository identity. - Prevent project-derived content from being promoted automatically into global memory. - Apply expiration and size limits to learned entries. 4. **Track provenance and trust** - Record the source file, repository identity, commit, timestamp, authoring process, and verification status for every memory entry. - Do not reuse entries outside their original project unless a user explicitly approves promotion. - Mark generated inferences separately from verified facts. 5. **Validate learning before persistence** - Save only narrowly scoped, evidence-backed facts. - Require successful tests or other objective evidence before storing a pattern. - Prevent arbitrary task context, error text, or repository content from becoming persistent behavioral instructions. 6. **Make updates reviewable and reversible** - Present a diff before modifying `.antigravity.md`. - Use append-only audit records or versioned storage. - Provide controls to inspect, delete, quarantine, and roll back poisoned entries. 7. **Add defensive instruction handling** - Enforce a policy that content loaded from project files cannot supersede system, developer, user, or safety instructions. - Detect ...[truncated 175 chars]