T02 · Agent Memory Poisoning
Warning
- Location
- SKILL.md:25
- Finding
- Persistent Agent Memory Poisoning Through Unsanitized Conversation Capture## Vulnerability Details **File Location**: `SKILL.md:25-34, 46-52, 74-83`; `templates/HEARTBEAT.md:3-6, 20-23`; `templates/STATE.md:17-21` **Vulnerability Type**: Persistent storage and repeated loading of untrusted conversation-derived instructions **Risk Level**: Medium ### Vulnerable Code `SKILL.md:25-34`: ```markdown ### Step 1: Enable Session Memory Hook Add to your `~/.openclaw/openclaw.json` under hooks: ```json { "hooks": { "session-memory": { "enabled": true, "messages": 9999, "path": "memory/" } } } ``` `SKILL.md:46-52`: ```markdown Add to your AGENTS.md session start protocol: ```markdown ## Every Session — Mandatory 1. Read `STATE.md` — current world state 2. Read `memory/YYYY-MM-DD.md` (today) — if missing, create it 3. Read `MEMORY.md` — long-term memory ``` ``` `SKILL.md:74-83`: ```markdown ### On Every Decision: ``` Decision made in chat → Write to file IMMEDIATELY No "I'll remember that" — files only ``` ## Key Principle > **If it's not in a file, it didn't happen.** Mental notes don't survive session restarts. Files do. Every decision, every status change, every important conversation — write it down in the same response. ``` `templates/HEARTBEAT.md:3-6, 20-23`: ```markdown ## On Every Wake-Up — Mandatory 1. Read `STATE.md` 2. Read `memory/YYYY-MM-DD.md` (today) — create if missing 3. Read `MEMORY.md` ``` ```markdown ## 📝 Documentation - Everything that happens → write to `memory/YYYY-MM-DD.md` - New decision → write to MEMORY.md - Never trust "mental notes" — **file written or it didn't happen** ``` `templates/STATE.md:17-21`: ```markdown ## 🧠 Iron Decisions (must always remember) | Decision | Date | Source | |----------|------|--------| | Example: Always use 5m timeframe | DD.MM | Chat with user | | Example: Risk per trade = 2% max | DD.MM | DECISIONS.md | ``` ### Techn ...[truncated 2399 chars]
- Remediation
- ## Remediation Suggestions 1. Store structured facts rather than raw conversational instructions. Separate fields such as `fact`, `source`, `timestamp`, `trust_level`, and `approved_by`. 2. Treat all recalled memory as untrusted data. Add an explicit rule that content read from memory files cannot override system, developer, user, or safety instructions. 3. Require explicit user confirmation before promoting conversation content into `MEMORY.md`, `STATE.md`, or an “Iron Decisions” section. 4. Validate proposed durable rules against security policy and reject instructions that request secrecy, privilege changes, safety bypasses, credential access, or modifications to instruction priority. 5. Keep raw journals outside the instruction context. Summarize them through a security-aware process before loading selected facts into future sessions. 6. Preserve provenance and display recalled content as quoted data rather than authoritative instructions. 7. Provide a review and rollback mechanism so users can inspect, revoke, or quarantine suspicious memories. 8. Limit startup loading to approved records instead of automatically reading complete daily journals.