T02 · Agent Memory Poisoning
Warning
- Location
- references/review-framework.md:43
- Finding
- Untrusted Match Data Can Poison Persistent Agent Memory## Vulnerability Details **File Location**: `references/review-framework.md:43-75`; related mandatory persistence instructions also appear in `SKILL.md:52-54`, `SKILL.md:84-92`, and `references/prediction-framework.md:248-266` **Vulnerability Type**: T02: Agent Memory Poisoning **Risk Level**: Medium ### Vulnerable Code ```markdown ### 3. Framework Optimization Based on deviation analysis: **Parameter adjustments:** - Adjust feature weights in logistic regression model - Update league-specific factors and coefficients - Calibrate motivation and environment factor scaling - Refine squad power decay calculations **Pattern recognition:** - Remember pre-match data features of this match - Remember league-specific odds patterns (盤路數據特徵) - Build league-specific calculation frameworks and analysis logic **Goal**: Achieve 70%+ accuracy for both Asian handicap and over/under predictions. --- ## Framework Storage Save the optimized analysis framework including: 1. **Data reading & statistics** - What data points proved most predictive 2. **Fundamental analysis logic** - Refined analysis methodology 3. **Analysis methods** - Updated model parameters and weights 4. **Win probability calculation** - Calibrated probability formulas 5. **Prediction model** - Updated logistic regression parameters ### Storage Location Save framework updates to memory files for persistence across sessions: - `~/.claude/projects/*/memory/football-prediction-framework.md` - Core framework parameters - `~/.claude/projects/*/memory/football-league-profiles.md` - League-specific profiles - `~/.claude/projects/*/memory/football-match-history.md` - Historical match records and accuracy ``` The related mandatory history-writing instruction is: ```markdown ## Step 6: Archiving (MANDATORY) This must be performed after every prediction and cannot be skipped. Append the match ID, league, match time, recommendation, predicted score, injury information, odds movement, and core reasoning to: ...[truncated 3297 chars]
- Remediation
- ## Remediation Suggestions 1. **Make persistence explicitly opt-in** - Ask for informed user approval before writing any match record or model update. - Allow predictions and reviews to complete without persistent storage. 2. **Use a least-privilege storage location** - Replace Agent-wide and wildcard memory paths with a dedicated Skill data directory. - Restrict writes to one explicitly resolved file owned by this Skill. - Do not write into unrelated project or general Agent memory. 3. **Separate observations from instructions** - Store match records as schema-validated JSON or another structured data format. - Never persist external text as executable Agent instructions. - Maintain model configuration separately from raw user and webpage content. 4. **Validate review inputs** - Verify match results against a trusted source before using them for learning. - Record source URL, retrieval time, match ID, and integrity metadata. - Mark user-supplied results as unverified until corroborated. 5. **Constrain automated learning** - Require a statistically meaningful sample size before changing weights. - Apply strict upper and lower bounds to every coefficient. - Limit the maximum adjustment permitted per review. - Reject anomalous or contradictory records. 6. **Add review and rollback controls** - Show proposed parameter changes to the user before committing them. - Version every model update and retain the prior known-good configuration. - Provide a straightforward way to inspect, reject, and revert changes. 7. **Sanitize externally sourced content** - Treat browser content and user input as untrusted data. - Extract only expected fields through an allowlisted schema. - Exclude embedded instructions, markup, scripts, and unrelated free-form text from persistent records.