T02 · Agent Memory Poisoning
- Location
scripts/log-download.ps1:1- Finding
Persistent Markdown Injection Through Unsanitized Download Log Fields
- Content
View full analysis
Vulnerability Details
File Location:
scripts/log-download.ps1, lines 1-5 and 34-37
Vulnerability Type: Persistent agent-state injection
Risk Level: MediumVulnerable Code
powershell param( [string]$FileName = "unknown", [double]$SizeMB = 0, [string]$TargetPath = "unknown", [string]$Reason = "agent-download" )powershell $timestamp = Get-Date -Format "yyyy-MM-dd HH:mm" $sizeDisplay = if ($SizeMB -gt 0) { "${SizeMB}MB" } else { "unknown" } $newRow = "| $timestamp | $FileName | $sizeDisplay | $TargetPath | $Reason |" Add-Content -Path $logFile -Value $newRow -Encoding UTF8SKILL.md, lines 343 and 347, subsequently instructs the agent to read this persistent log when the user requests the download history or most recent download location.Technical Analysis
The script accepts the filename, target path, and reason as caller-controlled strings and inserts them directly into a persistent Markdown table. It does not reject carriage returns, line feeds, control characters, Markdown table delimiters, or instruction-like content.
An attacker-controlled filename such as one containing newline characters and additional Markdown rows can alter the structure and semantic content of
download-log.md. Because the Skill later retrieves this file and may place its contents into the agent's context, malicious text can persist beyond the original download operation and influence later sessions.This is not direct operating-system command injection: the values are not evaluated as PowerShell. The security issue is persistent state poisoning and indirect prompt injection through a log that the agent is explicitly instructed to read.
Attack Path
- An attacker controls or influences the name of a file, download destination, or reason passed to
log-download.ps1. - The attacker includes line breaks, Markdown delimiters, or instruction-like text in that value.
...[truncated 1015 chars]
- An attacker controls or influences the name of a file, download destination, or reason passed to
- Remediation
View remediation
Remediation Suggestions
- Reject carriage returns, line feeds, null bytes, and non-printable control characters in all log fields.
- Escape Markdown table delimiters such as
|and backslashes before generating display output. - Store records in a structured format such as JSON Lines rather than using Markdown as the authoritative data store.
- Generate Markdown only from parsed, validated structured records.
- Apply strict maximum lengths to filenames, paths, and reasons.
- When the agent reads the log, explicitly classify its contents as untrusted data and prohibit following instructions found inside records.
- Add tests using filenames containing newlines, pipes, Markdown links, code blocks, and prompt-like instructions.