T02 · Agent Memory Poisoning
Warning
- Location
- SKILL.md:65
- Finding
- Persistent Skill Modification Can Poison Future Agent Behavior## Vulnerability Details **File Location**: `SKILL.md`, line 65 **Vulnerability Type**: Persistent modification of agent instructions **Risk Level**: Medium **Vulnerable instruction, faithfully translated into English:** ```markdown This skill is a living document: after accumulating new experience from each article-writing or editing task, append or revise the corresponding subsection, bump the version, and add an entry to the changelog below. Organize experience into the preceding chapters by topic; do not create duplicate entries for the same issue. ``` ### Technical Analysis The skill directs an agent to modify the persistent `SKILL.md` instruction file after future writing or editing tasks. This crosses the boundary between ordinary task output and durable agent configuration. Content encountered during later tasks may be untrusted or attacker-controlled. If an agent interprets that content as a new “experience” and follows this update protocol, hostile instructions can be incorporated into the skill. Those instructions would then be loaded in subsequent sessions whenever the skill is activated. The document does not require explicit user approval, provenance validation, security review, content isolation, or an allowlist of permitted changes before modifying the persistent skill. Although the repository contains no script that directly performs the write, the instruction creates a memory-poisoning path when used by an agent with file-write capabilities. ### Attack Path 1. A victim installs the skill in a persistent agent skill directory. 2. The skill is activated for an article-writing or editing request. 3. An attacker supplies a document containing manipulative instructions disguised as writing guidance, corrections, or newly discovered experience. 4. The agent treats the supplied material as an experience that should be retained under the living-document protocol. 5. If the agent has write access, it appends or ...[truncated 833 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the requirement for the agent to modify `SKILL.md` automatically after ordinary writing tasks. 2. Store proposed lessons in a separate, non-executable review file rather than directly in the loaded skill instructions. 3. Require explicit user confirmation before every persistent update, including a displayed diff of the proposed changes. 4. Restrict updates to predefined sections and reject content containing tool instructions, permission changes, external retrieval directives, shell commands, or attempts to override higher-priority instructions. 5. Record the source and provenance of every proposed lesson so untrusted document content cannot silently become persistent policy. 6. Keep the installed skill read-only during normal operation and perform updates only through a trusted, human-reviewed maintenance process. 7. Apply integrity verification or version-control review before loading a modified skill in later sessions.