T02 · Agent Memory Poisoning
Warning
- Location
- SKILL.md:197
- Finding
- Mandatory Persistent Agent Memory Updates Can Poison Future Sessions## Vulnerability Details **File Location**: `SKILL.md:197-201` **Vulnerability Type**: Persistent agent memory poisoning **Risk Level**: Medium The following is an English translation of the complete relevant source segment: ```markdown **Operations the AI must perform:** 1. Filter the doctor output and extract key repair information 2. Compare the backup file and interpret the diff 3. Report the repaired field, original value, and new value to the user 4. Record the lesson in MEMORY.md 5. Wait three seconds and verify the Gateway status ``` This requirement is also reinforced at `SKILL.md:29-31`, `SKILL.md:60-62`, and `SKILL.md:209`, as well as `TEST-GUIDE.md:150-151`. ### Technical Analysis The workflow mandates writing lessons derived from configuration repairs into the persistent `MEMORY.md` file. It does not require separate user approval for this persistent write, define an allowlist of permissible facts, sanitize diagnostic or configuration-derived content, establish retention limits, or provide a review and rollback process. Configuration data and diagnostic output may be influenced by an attacker, a compromised integration, or an incorrectly configured system. If the agent interprets such content as a valid lesson and stores it, the resulting rule can continue to influence later sessions. This changes the operation from temporary task execution into persistent modification of agent state. The vulnerability does not establish arbitrary code execution by itself. Exploitation depends on the agent having permission to modify its persistent memory and later consulting that memory. ### Attack Path 1. An attacker or faulty integration introduces misleading configuration data or causes misleading repair diagnostics. 2. The user invokes this configuration workflow. 3. The agent runs the repair process and interprets the attacker-influenced output as a reusable configuration lesson. 4. The mandatory workflow ca ...[truncated 1143 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the unconditional requirement to update `MEMORY.md`. 2. Require explicit, separate user confirmation before every persistent memory write. 3. Store only structured and allowlisted facts, such as a validated field name, schema version, approved value, authoritative source, and timestamp. 4. Never persist raw logs, authentication tokens, secrets, full configuration fragments, or uncontrolled user and tool output. 5. Validate every proposed lesson against the official schema and trusted documentation before storage. 6. Show the exact proposed memory entry to the user before writing it. 7. Scope entries to this specific skill and configuration version rather than using unrestricted global memory. 8. Add expiration, provenance, review, deletion, and rollback mechanisms. 9. Treat `doctor` output, log content, configuration values, and external documentation as untrusted data rather than instructions. 10. Prefer a task-local audit record over behavioral memory when persistence is not necessary.