T02 · Agent Memory Poisoning
Warning
- Location
- SKILL.md:14
- Finding
- Untrusted Conversation Content Can Be Persisted into the Skill's Long-Term Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 14–31 **Vulnerability Type**: Persistent agent memory poisoning through mandatory self-modification **Risk Level**: Medium ### Vulnerable Code Snippet The following is an English translation of the relevant directives in the source file: ```markdown ## 0. Continuous Update Protocol (Living Document, Mandatory) This skill is a living document and must continuously accumulate experience and errors. It is not a one-time artifact. Update triggers: - New pitfalls, phenomena, or countermeasures encountered while investigating or fixing Minecraft plugin vulnerabilities or security problems - New plugin-security requirements proposed by users that produce new best practices - Findings from server testing or official release cross-checking that cannot be discovered through static analysis alone Update rules: 1. Append content to the corresponding section. If no suitable section exists, create a new subsection and update the quick-index table. 2. Record each entry as: problem | symptom/error | countermeasure, and identify its source. 3. Update the version and updated date. 4. After every use of this skill, if the conversation contains experience worth retaining, proactively record it and tell the user that the skill was updated. 5. A redaction review is mandatory before updating. 6. A post-modification self-review is mandatory. 7. Every modification must update the version number, updated date, and changelog. ``` ### Technical Analysis The Skill explicitly instructs the agent to modify its own persistent instruction file using information obtained from future conversations. User-provided claims can consequently cross the boundary between untrusted session input and durable agent guidance. The included redaction checklist reduces privacy exposure, but it does not establish a trust boundary for technical content. In particular, the update protocol does not require: - Explicit use ...[truncated 2595 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Make the Skill read-only by default** - Remove the mandatory self-update requirement. - Treat `SKILL.md` as version-controlled reference material rather than writable memory. - Do not grant routine Skill invocations write permission to the installed Skill directory. 2. **Require explicit authorization** - Ask for clear user approval before proposing or applying any persistent modification. - Display the exact patch and destination file before writing. - Never infer approval merely because a conversation contains potentially reusable information. 3. **Separate proposals from trusted instructions** - Store suggested additions in a review-only file or pending-change queue. - Do not load pending material as active Skill instructions. - Require a maintainer-reviewed commit before incorporating proposed knowledge. 4. **Enforce source verification** - Require authoritative upstream advisories, release notes, commits, or reproducible testing evidence. - Do not persist technical claims based solely on user-provided statements. - Record provenance and verification status for every accepted entry. 5. **Restrict persistable content** - Prohibit persistence of shell commands, download URLs, credentials, server identifiers, and configuration changes unless independently reviewed. - Allow only narrowly structured facts with explicit source citations. - Continue using the existing redaction checks, but supplement them with integrity and provenance checks. 6. **Add rollback and integrity controls** - Keep all accepted changes under version control. - Require signed or reviewed commits where feasible. - Validate the Skill against a known-good checksum or approved revision before loading it. - Provide a straightforward rollback process for poisoned entries. ]]>