T02 · Agent Memory Poisoning
Warning
- Location
- SKILL.md:194
- Finding
- Automatic Persistent Memory Capture Enables Cross-Session Memory Poisoning<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 194-212 **Vulnerability Type**: Automatic storage and reinjection of insufficiently trusted conversational content **Risk Level**: Medium ### Complete Code Snippet ```markdown ### `auto-remember` Hook Fires after every agent response. Extracts facts, decisions, and preferences using pattern matching: - "I prefer..." → stored as preference - "We decided..." → stored as decision - "Remember that..." → stored as fact - "Key: value" patterns (structured data) **Limits:** Max 5 extractions per message, min 10 chars, deduplicates. ### `session-to-memory` Hook Fires when starting a new session. Summarizes the ending session and stores it as a searchable memory. ### `memory-bootstrap` Hook Fires on agent startup. Queries for relevant memories (preferences, recent decisions, pinned items) and injects them into context. ### `memory-enriched-tools` Hook Fires before tool results are saved. Appends related memories as context annotations to Read/Grep/Glob/Bash outputs. **To disable hooks:** Set `hooksEnabled: false` in plugin config. ``` ### Technical Analysis The documented hooks automatically extract and persist content after every agent response. The extraction rules include broad patterns such as `"Remember that..."` and `"Key: value"`, without documenting validation that distinguishes trusted facts from attacker-supplied instructions, secrets, or adversarial text. The stored data is subsequently injected into the agent's startup context and appended to tool results. This creates a cross-session trust-boundary issue: content originating in an untrusted conversation can become persistent state and later appear in a context where the agent may treat it as authoritative. Although `SKILL.md` advises users not to store credentials, that guidance is not an enforceable control. The documentation does not specify secret detection, instruction filtering, source attribution, user confirmation, inte ...[truncated 1488 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Disable automatic capture by default and require explicit user or administrator opt-in. 2. Require confirmation before storing extracted facts, preferences, decisions, or session summaries. 3. Treat every retrieved memory as untrusted data and clearly delimit it from system and developer instructions. 4. Reject or neutralize content that resembles agent directives, tool commands, policy overrides, or role instructions. 5. Add secret and personal-data detection before persistence, covering API keys, tokens, passwords, private keys, connection strings, and regulated personal information. 6. Replace broad pattern matching such as `Key: value` with a strict schema and allowlisted memory categories. 7. Record source identity, tenant, session, timestamp, confidence, and consent metadata for every memory. 8. Enforce tenant and user isolation in all search, bootstrap, listing, and enrichment operations. 9. Do not append memories automatically to Bash or other high-impact tool results. Require explicit retrieval and preserve provenance labels. 10. Provide user-visible review, correction, deletion, retention, and audit controls. 11. Apply short retention periods by default and encrypt persisted memories in transit and at rest. ]]>