T02 · Agent Memory Poisoning
Error
- Location
- SKILL.md:2
- Finding
- Mandatory Continuous Writes Can Poison Persistent Agent Memory<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 2-9 and 49-57 **Vulnerability Type**: Persistent memory poisoning through mandatory, self-triggering writes **Risk Level**: High ### Complete Code Snippet ```markdown description: Persist what the agent learns as it builds. Self-triggering — fires whenever the agent makes a decision, discovers a pattern, learns a convention, hits a gotcha, or gains knowledge worth keeping. Use continuously, not just at the end. Triggers on phrases like "good to know", "I'll remember that", "worth noting", "that's a pattern", "lesson learned", "this is how we do it", or any moment the agent learns something it would otherwise forget. # Hizal Write Write as you build. Not optional. ``` ```markdown ## Write One Chunk Per Decision Don't batch everything into one chunk at the end. Write as you go: - Made an architecture decision? → `write_knowledge` now - Learned a codebase convention? → `write_convention` now - Discovered something useful personally? → `write_memory` now - Found a custom type that fits better? → `write_chunk` now ``` ### Technical Analysis The skill makes persistent writes self-triggering and mandatory whenever the agent believes it has learned something. It does not require explicit user approval, provenance verification, or a trust assessment before information is committed to long-term agent or project state. An attacker can place false rules, conventions, architectural claims, or operational guidance in ordinary task input. If the agent interprets that content as a lesson or pattern, the skill directs it to store the content immediately. The persisted information may then continue to influence future sessions after the original untrusted input is no longer visible. This creates a durable trust-boundary violation between transient conversation content and persistent memory. ### Attack Path 1. An attacker supplies crafted task content containing a false convention, rule, or operat ...[truncated 888 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Remove the “self-triggering,” “continuous,” and “not optional” requirements. - Require explicit, informed user approval before every persistent write. - Treat conversation content, retrieved documents, repository text, and tool output as untrusted sources. - Add provenance metadata and trust classification to every proposed memory entry. - Present the exact content, destination scope, and injection behavior to the user before committing it. - Default to temporary session-local notes instead of durable memory. - Reject behavioral instructions, credentials, secrets, and unverified claims from persistent storage. - Add review, expiration, rollback, and deletion mechanisms for stored entries. - Prevent stored content from being interpreted as higher-priority instructions in future sessions. ]]>