T02 · Agent Memory Poisoning
- Location
SKILL.md:169- Finding
Persistent Agent-State Poisoning Through Automatic Skill Self-Modification
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 169–176
Vulnerability Type:T02: Agent Memory Poisoning
Risk Level: MediumComplete Code Snippet:
markdown ## Self-Evolution Mechanism After each execution of this Skill: 1. Evaluate whether the output achieved the intended goal: **pass / fail**. 2. If it fails, reflect on the cause of failure and append a “failure case + improvement suggestion” to `diary/YYYY-MM-DD.md`. 3. If a certain improvement suggestion is repeatedly mentioned in the most recent three executions, refine it into a formal rule and submit a PR to modify this `SKILL.md`.Technical Analysis
The mandatory self-evolution workflow instructs the agent to persist execution-derived content in
diary/YYYY-MM-DD.mdand promote repeatedly observed suggestions into formal Skill rules. This creates a durable path from task inputs and model-generated conclusions to instructions loaded by future sessions.The MATLAB papers, source comments, and other project materials processed by this Skill are potentially untrusted. If such content influences a failure diagnosis or improvement suggestion, the resulting persistent note may contain attacker-controlled or attacker-influenced guidance. Repetition can then cause that guidance to be incorporated into
SKILL.md, changing future agent behavior.This mechanism is outside the Skill’s stated MATLAB auditing and optimization purpose. It also lacks controls for provenance validation, content sanitization, human review, storage scope, and explicit authorization before persistent state or Skill instructions are modified. The instruction to submit a pull request additionally implies an unspecified external and durable action without a defined approval boundary.
Attack Path
- An attacker supplies a MATLAB project, paper, specification, source comment, or task instruction containing misleading or adversarial guidance.
- The content causes the optimization run to fail, ...[truncated 1578 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the automatic self-evolution mechanism from
SKILL.md. - Do not write retrospectives, failure cases, or improvement suggestions to persistent storage unless the user explicitly requests that action and approves the destination.
- Never automatically promote task-derived observations into agent instructions, persistent memory, or Skill rules.
- Require separate, informed human approval before modifying
SKILL.md, creating a commit, or submitting a pull request. - If diagnostic persistence is genuinely required:
- Use a user-selected path and clearly disclose every write.
- Treat papers, MATLAB comments, specifications, and task content as untrusted.
- Store structured observations rather than executable or imperative instructions.
- Record provenance for each observation.
- Sanitize embedded prompts and instruction-like content.
- Prevent diagnostic files from being automatically loaded as future instructions.
- Enforce retention limits and provide deletion controls.
- Keep post-run improvement recommendations in the current response by default, isolating them from future agent state.
- Remove the automatic self-evolution mechanism from