T02 · Agent Memory Poisoning
- Location
SKILL.md:45- Finding
Persistent Agent Memory Poisoning Through Self-Evolving Skill Instructions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 45–53
Vulnerability Type: Persistent storage of execution-derived instructions and modification of the skill’s governing rules
Risk Level: HighVulnerable Code
markdown ## Self-Evolution Mechanism After each execution of this Skill: 1. Evaluate whether the output achieved the intended goal: **pass / fail**. 2. If it fails, reflect on the cause of failure and append a “failure case + improvement suggestion” to `diary/YYYY-MM-DD.md`. 3. If a certain improvement suggestion is repeatedly mentioned in the most recent three executions, refine it into a formal rule and submit a PR to modify this `SKILL.md`.Technical Analysis
The skill directs the agent to persist failure analyses and improvement suggestions in
diary/YYYY-MM-DD.md. It then instructs the agent to promote repeatedly stored suggestions into formal rules and submit a pull request modifyingSKILL.md.This creates an unsafe path from task-controlled content to persistent, authoritative agent instructions. Simulation source code, papers, documentation, or user prompts processed by the skill may contain adversarial text designed to influence the generated failure analysis. If such content is incorporated into an improvement suggestion, it can persist beyond the current execution.
The repetition check does not establish trustworthiness. An attacker able to invoke the skill repeatedly, or influence three executions, could cause the same malicious suggestion to recur and qualify for promotion. Turning that suggestion into a rule in
SKILL.mdwould make it part of the instructions loaded during future sessions.This behavior is unrelated to the skill’s legitimate documentation-writing purpose and crosses a trust boundary between untrusted task inputs, persistent state, and governing instructions.
Attack Path
- An attacker supplies a user prompt, paper, source file, or other artifact containing instructions cr ...[truncated 1825 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the entire
Self-Evolution Mechanismsection fromSKILL.md. - Do not write task-derived reflections, recommendations, or user-controlled content into the skill directory or any state automatically loaded by future agent sessions.
- If quality telemetry is required, store it in a separate, access-controlled system as structured, non-executable data.
- Treat all prompts, papers, source files, logs, and generated reflections as untrusted input. Never promote their contents automatically into agent instructions.
- Require explicit human initiation and security review for every change to
SKILL.md; the agent should not autonomously submit instruction-changing pull requests. - Protect the skill directory using least-privilege permissions and make installed skill instructions read-only during normal execution.
- If feedback files must be retained, sanitize their contents, prevent them from being loaded as instructions, record provenance, and enforce retention limits.
- Add repository controls requiring designated reviewer approval for changes to skill instructions, particularly changes that introduce tool calls, persistence, external communication, or expanded filesystem access.
- Remove the entire