T02 · Agent Memory Poisoning
Warning
- Location
- SKILL.md:3
- Finding
- Unvalidated Promotion of Surfaced Context into Persistent Project Memory<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 3 and 24–35 **Vulnerability Type**: Persistent memory poisoning through broad automatic activation and unvalidated memory promotion **Risk Level**: Medium ### Complete Code Snippet ```yaml description: Close the agent's context session and consolidate what was learned. Self-triggering — fires when the agent finishes a task, wraps up work, or is about to go idle. Handles the keep/promote/discard review of surfaced memory chunks. Triggers on phrases like "I'm done", "that's it for now", "wrapping up", "let me commit and close out", "finished this task", or any time the agent is ending a work session. ``` ```markdown ### Promote Valuable for the team. Write it back as a PROJECT chunk: ```text # For architecture/design decisions hizal__write_knowledge(project_id="<id>", query_key="<key>", title="<title>", content="<chunk-content>") # For codebase conventions hizal__write_convention(project_id="<id>", query_key="<key>", title="<title>", content="<chunk-content>") ``` Then optionally delete the original AGENT chunk: ```text hizal__delete_context(project_id="<id>", id="<chunk-id>") ``` ``` ### Technical Analysis The skill self-triggers on broad task-completion conditions and instructs the agent to promote surfaced context chunks into persistent project knowledge or conventions. It does not require explicit user confirmation, provenance validation, sanitization, or a check that the chunk contains only factual project knowledge rather than instructions originating from untrusted task content. Consequently, misleading information or instruction-like content introduced during a task could be selected for promotion and remain available to future sessions. The optional deletion of the original agent-context chunk can reduce provenance and make subsequent review more difficult. This issue is limited to the behavior described by the skill instructions. The audited project contains no scripts, dep ...[truncated 1514 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require explicit user confirmation before promoting any surfaced chunk into persistent project memory. 2. Show the exact proposed title, query key, content, destination, and source provenance before performing a write. 3. Reject or quarantine chunks containing imperative instructions, tool-call directives, safety-policy changes, secrets, or content originating from untrusted artifacts. 4. Restrict automatic activation to explicit session-ending requests rather than generic completion phrases or idle conditions. 5. Preserve source attribution, including the originating file, task, session, and timestamp, with every promoted chunk. 6. Do not automatically delete the source context. Prefer reversible archival with a retention period and an audit log. 7. Require separate confirmation for deletion and verify that the project and chunk identifiers belong to the active session. 8. Provide a review mechanism to inspect, revise, revoke, and restore promoted project knowledge. ]]>