T02 · Agent Memory Poisoning
- Location
SKILL.md:86- Finding
Unvalidated Learning Data Can Be Persisted as Cross-Skill Instructions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 86-88 and 178-186
Vulnerability Type: Persistent agent-memory poisoning and skill-instruction hijacking
Risk Level: HighRelevant Code Snippets:
markdown ## Inject Rules into Skills Auto-add learned rules to relevant skill SKILL.md: **Location**: `skills/{skill-name}/SKILL.md`markdown Error occurs ↓ Record to memory/errors/ ↓ learning-engine analysis ↓ Extract patterns + Create rules ↓ Save to memory/learned-rules/ ↓ Auto-update relevant skill SKILL.md ↓ Publish event (lesson-learned)Technical Analysis
The skill instructs the agent to derive rules from error logs, self-evaluation results, and performance data, persist those rules under
memory/learned-rules/, and automatically insert them into other skills'SKILL.mdfiles.These input sources may contain untrusted or attacker-influenced content. The documented workflow does not specify:
- Validation of source authenticity or provenance
- Separation of observed data from executable agent instructions
- Sanitization of commands, URLs, tool directives, or prompt-like content
- An allowlist for permitted rule types
- Validation or containment of destination paths
- Human approval before modifying another skill
- Conflict detection or confidence requirements before applying a rule
- Integrity checks, rollback controls, or limits on propagation
Consequently, malicious content introduced into a learning source could be interpreted as a lesson and transformed into a durable instruction. Modification of another
SKILL.mdalso changes the instructions loaded by future agent sessions, creating both persistent memory poisoning and cross-skill instruction hijacking.Attack Path
- An attacker or compromised integration causes crafted content to appear in
memory/errors/, self-evaluation results, or performance data. - The c ...[truncated 1732 chars]
- Remediation
View remediation
Remediation Suggestions
- Treat all learning sources as untrusted data. Parse observations through a strict schema rather than copying free-form text into agent instructions.
- Separate data from instructions. Store learned observations in structured data files and have reviewed, static skill logic interpret only explicitly permitted fields.
- Apply an allowlist. Permit only narrowly defined rule types and reject shell commands, executable snippets, URLs, tool directives, role changes, and instruction-like payloads.
- Require human approval. Do not automatically modify any
SKILL.md; generate a proposed patch for review and explicit authorization. - Restrict write scope. Resolve and validate canonical destination paths, reject traversal and symlink targets, and prevent writes outside a dedicated learning-data directory.
- Add provenance and confidence controls. Record the source of each rule and require corroboration from multiple trusted observations before recommending it.
- Prevent uncontrolled propagation. Require an explicit allowlist of target skills and prohibit a learned rule from automatically changing unrelated skills.
- Add integrity and recovery mechanisms. Keep immutable audit logs, version all proposed changes, digitally verify trusted skill definitions where appropriate, and provide automatic rollback.
- Detect instruction injection. Scan proposed rules for attempts to override safety constraints, invoke tools, access secrets, execute commands, or communicate with external systems.
- Run with least privilege. The learning process should not have direct write access to production skill definitions; a separate reviewed deployment step should apply approved changes.