T02 · Agent Memory Poisoning
- Location
SKILL.md:253- Finding
Unconsented Persistent Storage of Attacker-Influenced Research Content
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, line 253
Vulnerability Type: Persistent memory poisoning and privacy-sensitive state retention
Risk Level: MediumComplete Code Snippet:
markdown 8. After delivering research — write summary to `memory/whatsapp/dms/<PHONE-sanitized>/context.md` if topic was importantTechnical Analysis
The skill instructs the agent to write research summaries into persistent, conversation-specific memory after completing a request. This behavior is not necessary for the skill's declared research-synthesis function and does not require explicit user consent.
The condition “if topic was important” is subjective and has no defined validation, data-minimization, retention, or deletion controls. Because research topics and conclusions originate from user input and externally retrieved sources, an attacker can influence the content written to this memory. If later sessions consume the stored context, crafted, inaccurate, or malicious claims may continue to affect future responses.
The path also scopes retained information using a sanitized phone-derived identifier. Although sanitization is referenced, no sanitization procedure or privacy control is defined. This creates a risk of retaining sensitive research interests or conclusions in a location associated with an identifiable conversation.
Attack Path
- An attacker or untrusted participant submits a research request containing crafted claims, misleading framing, or sensitive subject matter.
- The skill performs searches and creates a summary influenced by that input and by external web content.
- The agent determines subjectively that the topic is “important.”
- The summary is written to
memory/whatsapp/dms/<PHONE-sanitized>/context.mdwithout explicit approval. - A future session reads or relies on the persisted context.
- The stored claims influence later answers, allowing stale or atta ...[truncated 708 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove automatic memory persistence unless it is essential to the documented skill function.
- Require explicit, informed user consent before storing any research summary.
- Show the exact proposed memory content and destination before writing it.
- Replace the subjective “important” condition with a deterministic, user-controlled retention policy.
- Apply strict data minimization: exclude sensitive topics, personal data, credentials, identifiers, and unsupported external claims.
- Treat all user input and web-derived material as untrusted data; prevent stored content from being interpreted as agent instructions.
- Store provenance, timestamps, confidence, and expiration metadata with any retained factual claims.
- Define automatic expiration and provide mechanisms to inspect, correct, and delete stored memory.
- Avoid phone-derived storage paths where possible. If conversation scoping is required, use a non-reversible internal identifier and enforce access isolation.
- Validate and constrain the destination path to prevent traversal or cross-user writes.
- Require future sessions to revalidate stored research before relying on it for decisions or factual answers.