T02 · Agent Memory Poisoning
Warning
- Location
- SKILL.md:42
- Finding
- Unscoped Persistent Storage of User Behavior<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:42` **Vulnerability Type**: Persistent memory poisoning and privacy exposure **Risk Level**: Medium ### Vulnerable Code ```markdown 1. Ask the user for topics, if not provided, topics defaults: `tin-moi-nhat`, remember user behaviour and write to `USERS.md` ``` ### Technical Analysis The Skill directs the Agent to record unspecified “user behaviour” in a persistent `USERS.md` file. Persistent storage is not necessary to retrieve an RSS feed, and the instruction does not limit what may be recorded, require user consent, sanitize stored content, or define retention and deletion controls. Because “user behaviour” is undefined, an implementation may copy attacker-controlled or sensitive user content into durable Agent state. If that file is subsequently loaded as context or memory, stored text could influence later sessions. This crosses the least-privilege boundary of a stateless news-fetching operation and creates both privacy and memory-integrity risks. ### Attack Path 1. A user invokes the Skill and supplies a topic preference or related request containing crafted text. 2. Following `SKILL.md:42`, the Agent records the perceived behavior in `USERS.md`. 3. The content persists beyond the current news request. 4. If `USERS.md` is loaded in later sessions, the stored content may alter future Agent behavior or expose one user's preferences to another context. The exploitation path depends on the surrounding Agent actually implementing and later consuming `USERS.md`; the project does not itself contain code that performs this write. ### Impact Assessment The instruction may obtain persistent write access to Agent-managed memory even though only outbound RSS retrieval is required. Potential impact includes: - Retention of user preferences or other personal information without explicit consent. - Cross-session contamination of Agent behavior. - Persistent prompt or instruction injection if user- ...[truncated 258 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the instruction to record general user behavior; RSS retrieval should remain stateless by default. 2. If preference persistence is genuinely required, request explicit user consent before storing anything. 3. Store only a narrowly defined value, such as one allowlisted topic identifier, rather than free-form user text. 4. Validate stored values against the 18 supported topic names and reject instructions, markup, or arbitrary content. 5. Keep preference data separate from files interpreted as Agent instructions. 6. Define retention, access-control, and deletion mechanisms, including a way for users to inspect and erase saved preferences. 7. Avoid sharing a single preference file among unrelated users or sessions. ]]>