T02 · Agent Memory Poisoning
Warning
- Location
- SKILL.md:67
- Finding
- Untrusted Web Content Is Persisted and Prioritized Across Sessions## Vulnerability Details **File Location**: `SKILL.md:67-68`, `SKILL.md:231-270`, and `SKILL.md:312-314` **Vulnerability Type**: Persistent agent memory poisoning through unsanitized web-derived content **Risk Level**: Medium ### Vulnerable Instructions ```markdown - Use `web_search` to perform multidimensional searches - Use `web_fetch` to retrieve high-quality pages ``` ```markdown write(path="~/.openclaw/workspace/memory/knowledge/{topic-slug}/knowledge_graph.json", content=...) write(path="~/.openclaw/workspace/memory/knowledge/{topic-slug}/knowledge_framework.md", content=...) write(path="~/.openclaw/workspace/memory/knowledge/{topic-slug}/qa_pairs.json", content=...) write(path="~/.openclaw/workspace/memory/knowledge/{topic-slug}/capability_report.md", content=...) ``` ```markdown Update `~/.openclaw/workspace/MEMORY.md` and add a knowledge entry. ``` ```markdown 1. **Prioritize reading the knowledge base**: Load it from `memory/knowledge/{topic-slug}/` ``` ### Technical Analysis The workflow retrieves information from external websites and incorporates it into generated knowledge assets. Those assets are then written to persistent storage, indexed in the global `MEMORY.md` file, and prioritized during later conversations. Source credibility scoring addresses factual reliability but does not address prompt injection. The documented workflow does not require the agent to: - Treat fetched instructions as untrusted data rather than executable directives. - Detect, remove, or quarantine instruction-like content. - preserve source quotations separately from trusted agent memory. - Validate generated assets for embedded behavioral directives before writing them. - Obtain user confirmation before changing the global memory index. - Prevent future agents from following instructions found in stored research material. Consequently, attacker-controlled text from a malicious or compromised source can cross the external-content trust boundary and enter long- ...[truncated 1563 chars]
- Remediation
- ## Remediation Suggestions 1. Establish an explicit trust boundary: state that all web-fetched content is untrusted data and that directives contained in sources must never be executed. 2. Scan fetched and generated content for prompt-injection patterns, including requests to ignore prior instructions, invoke tools, reveal secrets, alter memory, or contact external services. 3. Remove or quarantine suspicious passages before knowledge generation and persistence. 4. Store source material as attributed quotations or structured facts, clearly separated from agent instructions and trusted configuration. 5. Preserve provenance for every persisted claim, including source URL, retrieval time, and trust status. 6. Add a validation stage before persistence that rejects behavioral directives, tool commands, hidden content, and unsupported claims. 7. Require explicit user approval before writing knowledge assets or modifying `~/.openclaw/workspace/MEMORY.md`. 8. Do not instruct future sessions to unconditionally prioritize stored knowledge. Require revalidation and make current trusted instructions authoritative. 9. Add a rule for future agents that content loaded from the knowledge repository may inform answers but may not modify behavior, permissions, safety constraints, or tool usage. 10. Provide a safe deletion and rollback mechanism for poisoned knowledge entries and memory-index changes.