T02 · Agent Memory Poisoning
Warning
- Location
- SKILL.md:17
- Finding
- Uncontrolled Configuration Guidance Written to Persistent Agent Memory## Vulnerability Details **File Location**: `SKILL.md:17`, `SKILL.md:23-25`, `SKILL.md:62-63`, `SKILL.md:165`, `SKILL.md:185`; related test expectations at `TEST-GUIDE.md:138` and `TEST-GUIDE.md:143-144` **Vulnerability Type**: T02: Agent Memory Poisoning **Risk Level**: Medium ### Vulnerable Content The following are faithful English translations of the relevant instructions in `SKILL.md`: ```text 5. Learn — Record lessons after doctor --fix. | Minor issues (spelling and formatting problems) | Learn and record automatically | Do not bother the user; record them in MEMORY.md | | Important configuration (affecting functions, channels, or authentication) | Notify the user and learn | Keep the user informed and avoid repeating the mistake | | Repeated errors | Notify, record, and summarize | Form a knowledge base and permanently avoid them | # Step 4: Record lessons (important!) # Record the correct configuration values learned in MEMORY.md. 4. Record lessons in MEMORY.md. 4. Learning is mandatory after repairs — Record the result in MEMORY.md. ``` The related test expectations in `TEST-GUIDE.md` reinforce the same behavior: ```text Purpose: Verify both feedback strategies (learn automatically for minor issues and notify the user for important issues). Expected results: - Minor issue: Repair automatically, record it in MEMORY.md, and do not bother the user. - Important issue: Notify the user, explain the impact, and record it in MEMORY.md. ``` ### Technical Analysis The Skill makes persistent writes to `MEMORY.md` a mandatory part of configuration validation and repair. Persistent Agent memory affects future sessions, so writing configuration-derived conclusions there crosses the boundary between temporary task output and long-term Agent state. The workflow does not define controls for: - Validating that a lesson is correct before persistence. - Excluding secrets, tokens, identifiers, endpoints, or ...[truncated 2648 chars]
- Remediation
- ## Remediation Suggestions 1. Remove mandatory writes to `MEMORY.md` from the standard repair workflow. 2. Place lessons and repair summaries in a task-local report by default. 3. Require explicit, informed user approval before any persistent memory update. 4. Permit persistence only after the proposed lesson has been verified against authoritative OpenClaw documentation and the applicable schema. 5. Store generalized guidance rather than raw configuration values. 6. Redact tokens, credentials, endpoints, account identifiers, paths, and other sensitive or environment-specific data. 7. Attach provenance, affected OpenClaw version, host or project scope, creation date, and expiration date to every approved entry. 8. Provide a review and deletion mechanism so users can inspect, correct, or remove stored lessons. 9. Treat configuration files, logs, diffs, and diagnostic output as untrusted data; never convert their embedded text directly into Agent instructions. 10. Update `TEST-GUIDE.md` so tests verify that persistent writes do not occur without explicit approval and sanitization.