T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:23
- Finding
- Persistent Agent Instruction Hijacking Through Self-Modifying Identity and Memory Files## Vulnerability Details **File Location**: `SKILL.md:23-29`, `SKILL.md:142-150`, `SOUL-TEMPLATE.md:4`, `SOUL-TEMPLATE.md:63-65`, `SOUL-TEMPLATE.md:96-99`, `MEMORY-SYSTEM.md:28-56`, `MEMORY-SYSTEM.md:170-176`, `MEMORY-SYSTEM.md:194-196` **Vulnerability Type**: Persistent instruction hijacking and agent memory poisoning **Risk Level**: High ### Vulnerable Snippets `SKILL.md:23-29`: ```markdown ## Installation To use this skill: 1. Copy `SOUL-TEMPLATE.md` to workspace as `SOUL.md` 2. Customize content for your agent 3. Create `memory/` folder 4. Configure AGENTS.md to load SOUL.md every session ``` `SKILL.md:142-150`: ```markdown ### Self-Reflection Loop ``` heartbeat → self-check → update SOUL.md if needed ↓ Accumulate insights in MEMORY.md ↓ Discover patterns → improve behavior ``` ``` The associated template directs the agent to read `SOUL.md` at every session start, gives it fixed economic priorities, and directs discovered patterns and methods to be written into `SOUL.md` or `TOOLS.md`. The memory guide similarly requires session-start loading of identity and context files and promotes raw daily records through weekly and long-term memory into `SOUL.md`. ### Technical Analysis The installation procedure places `SOUL.md` in the agent workspace and directs the operator to modify `AGENTS.md` so that the file is loaded during every session. This turns content in `SOUL.md` from passive documentation into persistent behavioral instructions. The self-reflection workflow compounds this risk by directing the agent to: 1. Collect session observations in daily memory files. 2. Promote selected content into weekly and long-term memory. 3. Incorporate fundamental patterns into `SOUL.md`. 4. Reload the resulting identity instructions in subsequent sessions. 5. Potentially update `TOOLS.md`, another file capable of influencing future tool behavior. No provenance enforcement, trusted-content boundary, approval gate, saniti ...[truncated 2587 chars]
- Remediation
- ## Remediation Suggestions 1. Do not configure `AGENTS.md` to load mutable memory or identity files as authoritative instructions. 2. Treat `SOUL.md`, `SELF.md`, `MEMORY.md`, and files under `memory/` as untrusted reference data rather than governing policy. 3. Separate immutable, administrator-approved policy from user-generated and session-generated memory. 4. Prohibit autonomous modification of `AGENTS.md`, `SOUL.md`, and `TOOLS.md`. 5. Require explicit, informed user approval for every proposed change to persistent behavioral policy. 6. Add provenance metadata to each memory entry, including its source session, author, creation time, and approval status. 7. Sanitize and classify content before promoting it between memory tiers. Reject embedded instructions, role changes, safety-policy modifications, and tool directives. 8. Use an allowlist of fields that may be persisted, such as factual project state, while excluding goals, credentials, identity rules, and executable instructions. 9. Apply filesystem permissions so routine agent operations cannot overwrite policy or tool-configuration files. 10. Add version control, integrity checks, reviewable diffs, and rollback support for all persistent state. 11. Remove fixed economic and identity priorities from the reusable template, or clearly mark them as optional examples that cannot supersede active user instructions or higher-level safety policies. 12. Ensure memory retrieval presents stored content as quoted historical data and never as instructions to execute.