T02 · Agent Memory Poisoning
Warning
- Location
- SKILL.md:16
- Finding
- Unvalidated Persistent Agent Memory Modification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:16-19`, `SKILL.md:48`, `SKILL.md:190-194`; related test expectation at `TEST-GUIDE.md:153-154` **Vulnerability Type**: Persistent memory poisoning through unvalidated model-generated lessons **Risk Level**: Medium ### Vulnerable Instructions The following is an English rendering of the relevant directives: ```text SKILL.md:16-19 | Issue type | Handling method | Example | | Minor issue (spelling or formatting) | Learn and record automatically | | Important configuration | Notify the user and learn | | Repeated error | Notify, record, and summarize | ``` ```bash # SKILL.md:48 # Record the correct configuration values learned into MEMORY.md ``` ```text SKILL.md:190-194 The AI must: 1. Filter doctor output and extract important repair information. 2. Compare the backup and interpret the diff. 3. Report repaired fields, old values, and new values. 4. Record lessons in MEMORY.md. 5. Wait three seconds and verify Gateway status. ``` ```text TEST-GUIDE.md:153-154 Minor issue: repair automatically and record it in MEMORY.md without bothering the user. Important issue: notify the user, explain the impact, and record it in MEMORY.md. ``` ### Technical Analysis The Skill requires the agent to convert configuration changes, `openclaw doctor --fix` output, backup differences, and troubleshooting observations into persistent entries in `MEMORY.md`. For minor issues, the write is expected to occur without notifying or obtaining approval from the user. No controls are defined for: - The authorized location or ownership of `MEMORY.md`. - The structure and permitted content of memory entries. - Validation against an authoritative configuration schema. - Provenance and trust classification of diagnostic information. - Exclusion of raw log content or instruction-like text. - Review of the exact proposed memory change before persistence. - Removal, expiration, rollback, or correction of inaccurate entries. ...[truncated 2380 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove mandatory and silent writes to general-purpose `MEMORY.md` from the configuration workflow. 2. Require explicit user approval before every persistent memory update, including minor corrections. 3. Display the exact proposed entry, destination path, reason, and source evidence before writing it. 4. Store configuration knowledge in a dedicated, Skill-owned structured file rather than general agent memory. 5. Permit only documented configuration keys and schema-validated values in persistent records. 6. Treat configuration files, command output, diffs, and logs as untrusted data. Never persist raw output or instruction-like text from those sources. 7. Record provenance for every entry, including the documentation URL, OpenClaw version, timestamp, and validation result. 8. Reject memory entries derived only from logs or model inference unless independently verified against authoritative documentation. 9. Implement rollback, deletion, expiration, and correction procedures for stored knowledge. 10. Separate task-local notes from cross-session memory. Prefer temporary task-local state unless persistence is necessary. 11. Update the test guide to verify that no persistent memory write occurs without approval and that malicious diagnostic text cannot become a durable instruction. ]]>