T02 · Agent Memory Poisoning
- Location
scripts/save_summary.py:191- Finding
Unvalidated conversation content can poison persistent Agent memory
- Content
View full analysis
Vulnerability Details
File Location:
scripts/save_summary.py:191-204
Additional Locations:scripts/add_memory.py:38-43,scripts/add_memory.py:68-76,scripts/add_memory.py:101-109,scripts/init_reme.py:39-42,references/best-practices.md:128-157,SKILL.md:380-406
Vulnerability Type: Persistent memory poisoning through unvalidated user-controlled content
Risk Level: HighVulnerable Code
python # Load messages from file messages_file = sys.argv[2] if sys.argv[1] == "--auto" else sys.argv[1] try: with open(messages_file, 'r', encoding='utf-8') as f: messages = json.load(f) print(f"✓ Loaded {len(messages)} messages from {messages_file}") # Save summary if sys.argv[1] == "--auto": await save_with_auto_cleanup(reme, messages) else: await save_session_summary(reme, messages)The persistence operation is performed without validating the content or authority of the supplied messages:
python # Write to memory file filename = f"memory/{date_str}.md" print(f"\n📝 Writing to {filename}...") await reme.summary_memory(messages=messages) print("✓ Summary saved")Technical Analysis
The Skill treats conversation content and user feedback as suitable input for persistent memory. A caller-controlled JSON file is parsed and its complete message array is passed to
reme.summary_memorywithout:- Restricting memories to a defined preference schema.
- Distinguishing descriptive preferences from executable Agent instructions.
- Verifying the identity or authority of the user creating the memory.
- Detecting prompt injection or tool-use directives.
- Requiring confirmation before creating a persistent rule.
- Assigning scope, expiration, provenance, or integrity metadata.
- Revalidating retrieved memories before they influence future behavior.
The related feedback-learning workflow similarly converts corr ...[truncated 2304 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace free-form persistent instructions with a strict, allowlisted preference schema, such as formatting style, language, or explicitly permitted notification settings.
- Reject memory values containing tool calls, security-policy changes, credential requests, file-transmission directives, or instructions to override higher-priority rules.
- Require explicit user confirmation before storing any cross-session memory.
- Record the authenticated owner, source conversation, creation time, scope, expiration time, and approval status for every memory.
- Keep descriptive user facts separate from behavioral instructions. Persistent records must never be executed or applied directly as prompts.
- Revalidate every retrieved memory against current safety policies before applying it.
- Scope memory by user, workspace, task, and session to prevent cross-user or cross-project contamination.
- Provide commands to inspect, revoke, and delete stored memories.
- Remove active user-attributed preferences bundled with the Skill package, or mark them as inert examples that are never loaded as user memory.
- Add adversarial tests covering persistent prompt injection, malicious tool directives, conflicting preferences, and stale or forged memory records.