T02 · Agent Memory Poisoning
Error
- Location
src/counterclaw/middleware.py:40- Finding
Detected malicious input is persisted in the Agent's long-term memory
- Content
View full analysis
None: """Log violation to MEMORY.md""" try: _ensure_memory_file() safe_text = _mask_pii(text) with open(MEMORY_PATH, "a") as f: timestamp = datetime.now().strftime("%Y-%m-%d %H:%M") f.write(f"\n## {timestamp} - CounterClaw Violation\n") f.write(f"**Context:** {context}\n") f.write(f"**Sample:** {safe_text[:100]}...\n") f.write(f"**Violations:** {violation.get('violations', [])}\n") except (IOError, OSError): pass ``` ```python async def check_input_async(self, text: str, log_violations: bool = True) -> Dict[str, Any]: """Async input check""" result = self.scanner.scan_input(text) if result["blocked"] and log_violations: _log_violation(result, "input", text) return result ``` ### Technical Analysis The interceptor writes the first 100 characters of input that it has classified as malicious into `~/.openclaw/memory/MEMORY.md`. This file is explicitly identified as Agent memory and may be loaded into future Agent contexts. The `_mask_pii()` operation only substitutes email addresses, telephone numbers, and credit-card-like values. It does not neutralize prompt instructions, Markdown, role directives, delimiters, or other content that could affect an Agent when the memory file is later consumed. Consequently, the security boundary is inverted: input blocked because it contains prompt-injection content is then copied into a more persistent and potentially trusted context. Writing raw attacker-controlled content to Agent memory is unnecessary for the core scanning function and exceeds minimum required filesystem privileg ...[truncated 1463 chars]- Remediation
View remediation