T02 · Agent Memory Poisoning
- Location
SKILL.md:78- Finding
Untrusted Repository Content Can Poison Persistent Agent Memory
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 78-125
Vulnerability Type: Persistent ingestion of untrusted repository content
Risk Level: MediumVulnerable Code Snippet:
markdown ### Step 2: Git Pull (If Applicable) Check if knowledge base is a git repository and pull latest changes before learning. ### Step 3: Scan Files Scan for supported files. Exclude: .git, node_modules, .obsidian, __pycache__, .venvmarkdown ### Step 5: Read and Extract Knowledge For each file: read content, identify theme/concepts/conclusions, extract key knowledge. ### Step 6: Store L1 Core Memory Create L1 memory entries using update_memory with appropriate category: - expert_experience: Domain expertise, best practices - project_introduction: Project/product overviews - learned_skill_experience: Reusable methods, procedures Title format: [Domain] Concise Topic Description ### Step 7: Build L2 Knowledge Index Create knowledge index with file path, theme, keywords mappings.Technical Analysis
The workflow pulls remote Git changes and subsequently treats supported repository files as trusted knowledge suitable for persistent agent memory. It does not define a trust boundary between source data and agent instructions, require review of newly pulled changes, detect instruction-like content, or obtain confirmation before writing extracted material through
update_memory.An attacker who can modify the configured repository can add adversarial text that appears to be documentation or domain guidance. The learning workflow may summarize that content into L1 memory or include it in the L2 index. Because L1 memory is designed to surface automatically in later conversations, attacker-controlled rules or misleading conclusions may continue influencing the agent after the original learning session ends.
The issue does not directly grant operating-system privileges or establish code exe ...[truncated 1234 chars]
- Remediation
View remediation
Remediation Suggestions
- Treat all repository contents, including documentation and comments, as untrusted data rather than executable agent instructions.
- Display the pulled commit, changed files, and proposed memory updates before ingestion, and require explicit user approval.
- Add detection and rejection rules for content that attempts to redefine agent behavior, request tool use, override safety policies, or instruct the agent to persist new rules.
- Store source provenance with every memory entry, including repository identity, commit hash, file path, and extraction timestamp.
- Provide a reviewable memory diff and rollback mechanism for every learning session.
- Allow users to configure file, directory, content, and secret-pattern exclusions.
- Prefer trusted branches or signed commits and warn when repository ownership, remote URLs, or signature status changes.
- Separate factual summaries from behavioral instructions and prohibit source files from creating persistent operating rules.