T02 · Agent Memory Poisoning
- Location
SKILL.md:137- Finding
Untrusted Project Files Can Poison Persistent Agent State
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:137-142, with related behavior inSKILL.md:18,SKILL.md:165-179,references/cold-start-guide.md:65-76, andreferences/todos-system.md:5-11
Vulnerability Type: Persistent agent-memory poisoning through unvalidated context files
Risk Level: MediumVulnerable Code and Instructions
SKILL.md:18establishes project files as authoritative:markdown **Files are the single source of truth.**SKILL.md:137-142directs every execution unit to consume the stored state and begin work:markdown 1. Read PROJECT.md → Understand project identity 2. Read state.json → Understand current progress 3. Read todos.json → Understand pending tasks 4. If decision context is needed → Read decisions.md 5. Begin workSKILL.md:165-179uses the same files as an instruction and result channel between agents:markdown Parent agent: 1. Update state.json (current task, expected output) 2. Spawn child agent Child agent: 1. Read state.json → Understand task 2. Execute task 3. Update state.json (results, progress) 4. End Parent agent: 1. Read state.json → Retrieve results 2. Continue workreferences/cold-start-guide.md:65-76further directs a child agent to execute delegated work obtained from the file:markdown Step 1: Read context prepared by parent agent ├── Read state.json → Understand delegated task ├── Check delegated_to and expected_output └── Check input_files or other inputs Step 2: Execute task ├── Complete delegated work ├── Generate output └── Update state.json (results, output files) Step 3: End └── Parent agent will read resultsreferences/todos-system.md:5-11encourages autonomous operation based on persisted data:markdown ## Core Philosophy **Agent manages autonomously, not dependent on user instructions.** todos.json is the Agent's own todo list, used for: ...[truncated 3619 chars]- Remediation
View remediation
Remediation Suggestions
-
Declare all context content untrusted. Explicitly state that project files contain data only and cannot override system instructions, developer instructions, safety controls, current user intent, or workspace boundaries.
-
Require confirmation before action. Require explicit approval from the current user before executing any task recovered from persistent files. Apply this requirement consistently to main sessions, child agents, cron jobs, and heartbeat sessions.
-
Separate data from instructions. Replace free-form imperative fields with narrowly defined structured fields. Stored values should describe project state rather than direct the agent to invoke tools or perform arbitrary actions.
-
Enforce schemas and field allowlists. Validate
state.jsonandtodos.jsonagainst strict JSON schemas. Reject unknown fields, malformed types, absolute or traversal-based file paths, embedded tool-call syntax, and content that attempts to modify agent policy. -
Constrain delegated files and actions. Resolve input and output paths against an approved project root, reject paths escaping that root, and define an allowlist of operations permitted in unattended sessions.
-
Add provenance and integrity controls. Record who or what updated each state entry, when it was updated, and from which trusted workflow. Where appropriate, use signatures, authenticated commits, protected branches, or integrity hashes to detect unauthorized changes.
-
Use privilege separation. Run unattended and child-agent workflows with minimal filesystem and network permissions. Do not expose credentials, deployment access, unrestricted shell execution, or unrelated directories merely because a stored task requests them.
-
Prevent automatic propagation. Before writing recovered instructions or child-agent results back into persistent state, sanitize and review them so that attacker-controlled directives are not pres ...[truncated 266 chars]
-