T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:25- Finding
Persistent Agent Memory Poisoning Through Unsanitized Conversation Capture
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:25-34, 46-52, 74-83;templates/HEARTBEAT.md:3-6, 20-23;templates/STATE.md:17-21
Vulnerability Type: Persistent storage and repeated loading of untrusted conversation-derived instructions
Risk Level: MediumVulnerable Code
SKILL.md:25-34:markdown ### Step 1: Enable Session Memory Hook Add to your `~/.openclaw/openclaw.json` under hooks: ```json { "hooks": { "session-memory": { "enabled": true, "messages": 9999, "path": "memory/" } } }SKILL.md:46-52:markdown Add to your AGENTS.md session start protocol: ```markdown ## Every Session — Mandatory 1. Read `STATE.md` — current world state 2. Read `memory/YYYY-MM-DD.md` (today) — if missing, create it 3. Read `MEMORY.md` — long-term memorytext `SKILL.md:74-83`: ```markdown ### On Every Decision:Decision made in chat → Write to file IMMEDIATELY No "I'll remember that" — files only
text ## Key Principle > **If it's not in a file, it didn't happen.** Mental notes don't survive session restarts. Files do. Every decision, every status change, every important conversation — write it down in the same response.templates/HEARTBEAT.md:3-6, 20-23:markdown ## On Every Wake-Up — Mandatory 1. Read `STATE.md` 2. Read `memory/YYYY-MM-DD.md` (today) — create if missing 3. Read `MEMORY.md`markdown ## 📝 Documentation - Everything that happens → write to `memory/YYYY-MM-DD.md` - New decision → write to MEMORY.md - Never trust "mental notes" — **file written or it didn't happen**templates/STATE.md:17-21:markdown ## 🧠 Iron Decisions (must always remember) | Decision | Date | Source | |----------|------|--------| | Example: Always use 5m timeframe | DD.MM | Chat with user | | Example: Risk per trade = 2% max | DD.MM | DECISIONS.md |Techn
...[truncated 2399 chars]
- Remediation
View remediation
Remediation Suggestions
- Store structured facts rather than raw conversational instructions. Separate fields such as
fact,source,timestamp,trust_level, andapproved_by. - Treat all recalled memory as untrusted data. Add an explicit rule that content read from memory files cannot override system, developer, user, or safety instructions.
- Require explicit user confirmation before promoting conversation content into
MEMORY.md,STATE.md, or an “Iron Decisions” section. - Validate proposed durable rules against security policy and reject instructions that request secrecy, privilege changes, safety bypasses, credential access, or modifications to instruction priority.
- Keep raw journals outside the instruction context. Summarize them through a security-aware process before loading selected facts into future sessions.
- Preserve provenance and display recalled content as quoted data rather than authoritative instructions.
- Provide a review and rollback mechanism so users can inspect, revoke, or quarantine suspicious memories.
- Limit startup loading to approved records instead of automatically reading complete daily journals.
- Store structured facts rather than raw conversational instructions. Separate fields such as