T02 · Agent Memory Poisoning
Warning
- Location
- SKILL.md:55
- Finding
- Untrusted Transcript Content Can Be Persisted to Agent Memory## Vulnerability Details **File Location**: `SKILL.md`, lines 55-57 **Vulnerability Type**: Persistent agent memory poisoning **Risk Level**: Medium **Vulnerable Code Snippet**: ```markdown - **Backstage:** Auto-add NOW items to current epic-notes/ - **ROADMAP:** Suggest LATER items as new epics - **Memory:** Log DECISIONS to memory/YYYY-MM-DD.md ``` ### Technical Analysis The skill processes transcripts from external AI conversations and instructs the agent to automatically add extracted items to project notes and log classified decisions to persistent memory. It does not specify a mandatory trust boundary, sanitization process, provenance control, or user-confirmation step before these writes occur. Because transcript content is untrusted, an attacker can phrase malicious instructions as previously agreed decisions. If the model classifies that content under `DECISIONS`, the content can be written to `memory/YYYY-MM-DD.md`. Future agent sessions may load the poisoned entry as trusted historical context, allowing the attack to persist beyond the original triage operation. This finding is limited to the documented workflow. The audited project contains no executable scripts, dependencies, network retrieval, credential access, or direct evidence of arbitrary code execution. ### Attack Path 1. An attacker creates or modifies an AI transcript supplied to the skill. 2. The transcript presents attacker-controlled instructions as decisions that were already agreed upon. 3. The skill parses the transcript and classifies those instructions under `DECISIONS`. 4. Following the documented integration behavior, the agent writes the extracted content to `memory/YYYY-MM-DD.md`. 5. A later session loads the memory entry as persistent context. 6. The poisoned entry may influence future planning or agent behavior, including attempts to weaken safeguards, misuse tools, or prioritize attacker-selected actions. ### Impact Assessmen ...[truncated 559 chars]
- Remediation
- ## Remediation Suggestions 1. Treat every transcript and every extracted item as untrusted data rather than executable agent instructions. 2. Make triage read-only by default. Return proposed note and memory changes in the response without writing them automatically. 3. Require explicit, per-write user confirmation before modifying `epic-notes/`, `ROADMAP`, or `memory/` files. 4. Preserve provenance for every stored item, including its source transcript, extraction date, and unverified status. 5. Store extracted transcript content as clearly delimited quotations so embedded instructions cannot be mistaken for governing agent rules. 6. Reject or quarantine entries that request changes to system prompts, safety constraints, permissions, tool behavior, credentials, or trust policies. 7. Apply an allowlist for acceptable decision-record fields and prevent transcript content from supplying file paths or write destinations. 8. Show the exact proposed content and destination to the user before approval, and maintain an audit log or reversible change history.