T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:11- Finding
Automatic Persistence of Conversation-Controlled Information into Agent Memory
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 11–19, 25, 38–50, and 78–80
Vulnerability Type:T02: Agent Memory Poisoning
Risk Level: MediumVulnerable Skill Instructions
The following is an English translation of the complete relevant instructions:
markdown Automatically save important information to memory files every two conversation turns. ## How It Works 1. Every two conversation turns — automatically inspect and save memories 2. Manual trigger — save immediately when the user says "save memory" 3. Intelligent detection — save automatically when important information is detected 4. Write information to `memory/YYYY-MM-DD.md` 5. Periodically organize it into the long-term memory file `MEMORY.md` The system automatically detects the number of conversation turns and saves memory after every two turns. Automatically save: - Important decisions and agreements - User preferences and settings - Tasks and deadlines - Project progress and status - Learned user information - Do not save casual conversation or temporary content - Do not save sensitive information such as passwords or keys Memory file locations: - Daily memory: `memory/YYYY-MM-DD.md` - Long-term memory: `MEMORY.md` 1. Memory files will continue to grow and should periodically be consolidated into `MEMORY.md`. 2. Sensitive information will not be saved automatically and requires manual confirmation. 3. Memory is saved automatically every two conversation turns without manual action.Technical Analysis
The Skill instructs the agent to identify information considered important and persist it automatically after every two conversation turns. It also directs the agent to promote daily records into
MEMORY.md, creating durable cross-session state.Conversation participants can control the statements from which decisions, preferences, tasks, project status, and user informatio ...[truncated 2241 chars]
- Remediation
View remediation
Remediation Suggestions
- Require explicit, informed user confirmation before every memory write and before promoting an entry into
MEMORY.md. - Show the exact proposed memory entry to the user and support approval, editing, or rejection.
- Restrict stored data to an allowlisted schema of factual fields. Do not store executable instructions, role changes, safety exceptions, tool commands, or behavioral directives.
- Record provenance for every entry, including timestamp, conversation identifier, source role, triggering message, and approval status.
- Treat all stored memory as untrusted data rather than authoritative instructions when it is loaded later.
- Separate preferences and factual notes from agent instructions, and ensure memory cannot override system, developer, safety, or current user instructions.
- Apply deterministic detection and redaction for credentials, authentication tokens, personal data, and operational details before persistence.
- Require a separate review before daily records are consolidated into long-term memory.
- Add retention limits, expiration dates, deduplication, audit logs, and user-accessible inspection and deletion controls.
- Disable automatic writes based solely on turn count; use an explicit opt-in workflow instead.
- Require explicit, informed user confirmation before every memory write and before promoting an entry into