T02 · Agent Memory Poisoning
Warning
- Location
- SKILL.md:197
- Finding
- Unrestricted Persistence of Configuration-Derived Content in Agent Memory## Vulnerability Details **File Location**: `SKILL.md`, lines 29-31, 62, 197-201, and 209 **Vulnerability Type**: Persistent agent-memory poisoning **Risk Level**: Medium ### Vulnerable Instructions The following is an English rendering of the relevant source instructions: ```markdown | Minor issues (spelling and formatting errors) | Self-learn and record | Do not bother the user; record them in MEMORY.md | | Important configuration (affecting functions, channels, or authentication) | Notify the user and learn | Keep the user informed and avoid making the same mistake again | | Repeated errors | Notify, record, and summarize | Build a knowledge base to prevent them permanently | # Record learned correct configuration values in MEMORY.md **Operations the AI must perform:** 1. Filter the doctor output and extract key repair information 2. Compare the backup file and interpret the diff 3. Report repaired fields, original values, and new values to the user 4. Record lessons in MEMORY.md 5. Wait three seconds and verify Gateway status 4. **Learning after repair is mandatory** — Record it in MEMORY.md ``` ### Technical Analysis The Skill mandates writing lessons derived from configuration files, backup diffs, and diagnostic output into the persistent `MEMORY.md` state. This behavior is repeated as a required workflow step rather than presented as an optional action requiring separate user approval. No controls define: - Which configuration fields may be persisted. - How credentials, tokens, channel identifiers, or personal data must be redacted. - Whether diagnostic content is trusted before it is converted into a persistent lesson. - How long entries remain in memory or which future sessions may consume them. - Whether raw configuration values, diffs, or log content are prohibited. - How a user can review or reject the proposed memory entry. The Skill explicitly covers authentication, channel, model, ...[truncated 2080 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the unconditional requirement to write lessons into `MEMORY.md`. 2. Store validation results in a task-local audit report by default rather than in cross-session memory. 3. Require explicit user approval for the exact proposed memory entry before any persistent write. 4. Allowlist safe metadata, such as documented field names and schema versions; prohibit raw values from authentication, channel, session, user, and endpoint fields. 5. Redact tokens, credentials, identifiers, URLs containing secrets, personal data, and other sensitive values before presenting or storing a summary. 6. Never persist raw configuration files, backup diffs, logs, command output, or untrusted error messages. 7. Clearly separate trusted documentation-derived rules from observations derived from local configuration or diagnostic output. 8. Validate memory entries against a strict schema and reject imperative instructions, tool commands, role changes, and unrelated content. 9. Record provenance, scope, creation time, and expiration for every approved entry, and provide a user-controlled review and deletion mechanism. 10. Update `TEST-GUIDE.md` so tests verify that sensitive or attacker-influenced values cannot enter persistent memory.