T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:197- Finding
Unrestricted Persistence of Configuration-Derived Content in Agent Memory
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 29-31, 62, 197-201, and 209
Vulnerability Type: Persistent agent-memory poisoning
Risk Level: MediumVulnerable Instructions
The following is an English rendering of the relevant source instructions:
markdown | Minor issues (spelling and formatting errors) | Self-learn and record | Do not bother the user; record them in MEMORY.md | | Important configuration (affecting functions, channels, or authentication) | Notify the user and learn | Keep the user informed and avoid making the same mistake again | | Repeated errors | Notify, record, and summarize | Build a knowledge base to prevent them permanently | # Record learned correct configuration values in MEMORY.md **Operations the AI must perform:** 1. Filter the doctor output and extract key repair information 2. Compare the backup file and interpret the diff 3. Report repaired fields, original values, and new values to the user 4. Record lessons in MEMORY.md 5. Wait three seconds and verify Gateway status 4. **Learning after repair is mandatory** — Record it in MEMORY.mdTechnical Analysis
The Skill mandates writing lessons derived from configuration files, backup diffs, and diagnostic output into the persistent
MEMORY.mdstate. This behavior is repeated as a required workflow step rather than presented as an optional action requiring separate user approval.No controls define:
- Which configuration fields may be persisted.
- How credentials, tokens, channel identifiers, or personal data must be redacted.
- Whether diagnostic content is trusted before it is converted into a persistent lesson.
- How long entries remain in memory or which future sessions may consume them.
- Whether raw configuration values, diffs, or log content are prohibited.
- How a user can review or reject the proposed memory entry.
The Skill explicitly covers authentication, channel, model, ...[truncated 2080 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the unconditional requirement to write lessons into
MEMORY.md. - Store validation results in a task-local audit report by default rather than in cross-session memory.
- Require explicit user approval for the exact proposed memory entry before any persistent write.
- Allowlist safe metadata, such as documented field names and schema versions; prohibit raw values from authentication, channel, session, user, and endpoint fields.
- Redact tokens, credentials, identifiers, URLs containing secrets, personal data, and other sensitive values before presenting or storing a summary.
- Never persist raw configuration files, backup diffs, logs, command output, or untrusted error messages.
- Clearly separate trusted documentation-derived rules from observations derived from local configuration or diagnostic output.
- Validate memory entries against a strict schema and reject imperative instructions, tool commands, role changes, and unrelated content.
- Record provenance, scope, creation time, and expiration for every approved entry, and provide a user-controlled review and deletion mechanism.
- Update
TEST-GUIDE.mdso tests verify that sensitive or attacker-influenced values cannot enter persistent memory.
- Remove the unconditional requirement to write lessons into