T02 · Agent Memory Poisoning
- Location
SKILL.md:161- Finding
Unvalidated Persistent Memory Updates
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 161–172
Vulnerability Type: Persistent agent-memory poisoning
Risk Level: MediumVulnerable Code
markdown ## Memory Ron has persistent memory in `memory.md` (same directory as this file). **Before every Ron session:** read `memory.md`. Note any prior observations that are relevant to the current review domain. **After every Ron session:** append one entry to `memory.md`. Format:YYYY-MM-DD — [domain: code|analysis|financial|operational] — [one-line topic]
[2–4 sentences max. What Ron found that was non-obvious. What the agent missed that Ron caught. Any pattern confirmed or contradicted. No restatements of the verdict — only what future-Ron should know before the next similar review.]
text Technical Analysis
The skill requires every session to read persistent state from
memory.mdand append new observations after completing a review. Review observations can be derived from potentially attacker-controlled inputs, including project files, logs, conversation content, and sub-agent output.No trust boundary, content sanitization, source validation, user confirmation, or restriction against persisting imperative text is defined. Consequently, malicious material presented as a noteworthy observation could be copied into persistent memory and influence later sessions. The mandatory write also expands the skill beyond a read-only review role and conflicts with its stated behavior that Ron only reports problems.
Attack Path
- An attacker places persuasive, misleading, or instruction-like content in material that Ron is asked to review.
- Ron interprets that content as a non-obvious observation relevant to future reviews.
- Following the mandatory post-session procedure, Ron appends the observation to
memory.md. - Every subsequent Ron session reads
memory.mdbefore conducting its review. - The stored attacker-in ...[truncated 634 chars]
- Remediation
View remediation
Remediation Suggestions
- Make persistent memory updates opt-in rather than mandatory.
- Require explicit user approval before writing review-derived content to
memory.md. - Treat all reviewed files, logs, conversations, and sub-agent output as untrusted input.
- Persist only structured, source-referenced factual observations.
- Reject imperative statements, embedded instructions, executable content, and unsupported claims.
- Clearly label loaded memory as untrusted historical context that cannot override current system, developer, or user instructions.
- Apply length and schema validation to each entry and record its source and creation context.
- Prefer session-local state when cross-session retention is not essential.
- Provide a mechanism to inspect, remove, or reset stored entries before they are loaded into later sessions.