T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:74- Finding
Persistent Prompt Injection Through Untrusted Conversation Memory
- Content
View full analysis
/ # Write to memory/whatsapp/dms//context.md: # Name, role, last interaction date, what was discussed, current status ``` **No exceptions. Every DM = a context file.** ``` The stored data is subsequently loaded into the agent's context: ```markdown ### Before Responding — Inject Context 1. Extract JID or phone from inbound metadata 2. If group: run wa_context "group" "$JID" 10 If DM: run wa_context "dm" "$PHONE" 10 3. Use context to inform your response 4. After responding: log anything worth remembering ``` ### Technical Analysis The skill requires inbound WhatsApp interactions to be persisted and later used to inform responses. It does not establish a trust boundary between conversation data and agent instructions, nor does it require sanitization, structured summarization, provenance labels, or filtering of instruction-like content. An external sender can therefore submit text designed to look like a persistent instruction, such as a direction to ignore recipient-validation rules or disclose information in later sessions. If that text is copied or summarized into `context.md`, it survives session restarts. The instruction to read and use the context before responding creates a pe ...[truncated 1454 chars]- Remediation
View remediation