T02 · Agent Memory Poisoning
Warning
- Location
- SKILL.md:205
- Finding
- Unrestricted Silent Persistence of Conversation Content## Vulnerability Details **File Location**: `SKILL.md`, lines 205-218 **Vulnerability Type**: Persistent storage of attacker-controlled conversation content **Risk Level**: Medium ### Vulnerable Code ```markdown ### During Conversation 1. **User gives concrete detail?** → Write to SESSION-STATE.md BEFORE responding 2. **Important decision made?** → Store in Git-Notes (SILENTLY) 3. **Preference expressed?** → `memory_store` with importance=0.9 ### On Session End 1. Update SESSION-STATE.md with final state 2. Move significant items to MEMORY.md if worth keeping long-term 3. Create/update daily log in memory/YYYY-MM-DD.md ``` The associated write-ahead-log instructions reinforce automatic persistence: ```markdown | Trigger | Action | |---------|--------| | User states preference | Write to SESSION-STATE.md → then respond | | User makes decision | Write to SESSION-STATE.md → then respond | | User gives deadline | Write to SESSION-STATE.md → then respond | | User corrects you | Write to SESSION-STATE.md → then respond | ``` ### Technical Analysis The Skill instructs the agent to persist broadly defined user-provided details before responding and to store decisions in Git Notes silently. It does not define a trust boundary, consent check, provenance model, sensitive-data filter, retention period, or restriction against recording instructions embedded in untrusted content. Because the stored material can later be retrieved through session-state loading, vector recall, Git Notes, or curated memory, attacker-controlled content may continue to influence future sessions. This is particularly risky if an attacker frames persistent instructions as a preference, decision, correction, or other concrete detail. Persistent memory is necessary for the Skill's declared purpose, but indiscriminate and silent capture exceeds the minimum privilege needed for task continuity. A safer design would persist only narrowly defi ...[truncated 1263 chars]
- Remediation
- ## Remediation Suggestions 1. Require explicit user consent before enabling persistent capture. 2. Replace the broad “concrete detail” rule with a strict allowlist of approved memory categories. 3. Never persist passwords, API keys, authentication tokens, private keys, financial data, health data, or other sensitive information. 4. Store external instructions and retrieved text as untrusted data, never as authoritative agent policy. 5. Record provenance, creation time, source, confidence, and expiration for every memory entry. 6. Require confirmation before storing behavioral rules, corrections, or high-impact decisions. 7. Add retention limits, review workflows, export controls, and reliable deletion across files, Git Notes, and vector storage. 8. Avoid silent storage; notify the user when durable memory is created unless the user has explicitly enabled a clearly documented automatic-capture mode.