T02 · Agent Memory Poisoning
- Location
SKILL.md:61- Finding
Persistent Agent-State Modification Without Explicit Consent
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 61–68 and 142–162
Vulnerability Type: Persistent memory poisoning through automatic capture and synchronization of conversation-derived instructions
Risk Level: MediumVulnerable Code Snippet
markdown ### Phase E – Lessons Captured (Auto-Iterate) At the end of the conversation, append three categories of experience to `evolution.json`: - `preferences`: User's preferred output style or delivery format - `fixes`: Issues encountered this session and how they were resolved - `custom_prompts`: Strong prompts that can be reused directly next time Also sync the learnings back into the "Experience Enhancements" section of `SKILL.md`.markdown ## 7) Auto-Iteration Protocol Trigger an experience update for this Skill when any of the following conditions are met: - User explicitly responds with "this is great" or "this isn't working" - A build error occurs and is resolved - A deviation between the plan and the actual implementation is corrected ### Update Structure `evolution.json` follows this structure: { "last_updated": "ISO_DATETIME", "preferences": [], "fixes": [], "custom_prompts": "" } ### Principles for Writing Learnings - Preferences → write abstract rules (reusable across projects) - Fixes → write "trigger condition + resolution approach" - Prompts → write instructions that can be pasted directlyTechnical Analysis
The Skill requires conversation-derived content to be written into
evolution.jsonand then synchronized intoSKILL.md. These files represent persistent behavioral state that can be loaded in later sessions. In particular, thecustom_promptsfield is designed to retain reusable instructions, while the synchronized “Experience Enhancements” section directly changes the Skill’s future instruction context.The update process does not require explicit user approval and defines no trust-boundary validation, sanitization, provenance track ...[truncated 1888 chars]
- Remediation
View remediation
Remediation Suggestions
- Make all persistent learning explicitly opt-in rather than mandatory or automatic.
- Display the exact proposed changes and require user confirmation before writing to
evolution.json. - Do not automatically rewrite
SKILL.md; keep runtime observations separate from trusted Skill instructions. - Restrict persisted data to a validated schema containing narrowly scoped, declarative preferences.
- Reject entries that attempt to modify authority, safety rules, tool permissions, secret handling, execution policy, or unrelated future tasks.
- Normalize and sanitize stored content, including length limits and rejection of embedded instruction blocks.
- Record provenance for every entry, including source session, timestamp, author, and approval status.
- Scope each learning to the relevant project or task instead of applying it globally.
- Provide review, rollback, expiration, and deletion mechanisms for persisted entries.
- Add tests proving that untrusted user text cannot become executable or authoritative future-session instructions without explicit approval.