T02 · Agent Memory Poisoning
Warning
- Location
- SKILL.md:114
- Finding
- Untrusted External Content Is Persisted Verbatim Without Prompt-Injection Controls## Vulnerability Details **File Location**: `SKILL.md`, lines 39 and 114–131; the unsafe behavior is reiterated at line 302 **Vulnerability Type**: Persistent indirect prompt injection through memory ingestion **Risk Level**: Medium **Relevant Code Snippet**: ```markdown Don't rewrite or summarize the source content. Preserve it verbatim in the note — you'll add structured observations alongside it. ``` ```python # Lines 114–131 Create the primary note for the ingested content. This is the "record of what happened" — it preserves the raw material and adds structured metadata. ### Meeting / Conversation Note write_note( title="NovaTech Meeting - Jordan Rivera - Feb 22, 2026", directory="meetings/2026", note_type="meeting", tags=["meeting", "novatech", "federated-learning"], metadata={"date": "2026-02-22"}, content=""" # NovaTech Meeting - Jordan Rivera - Feb 22, 2026 Brief one-sentence summary of what this meeting was about. ## Transcript [Preserve all source content verbatim — do not summarize or rewrite] ``` ```markdown - **Preserve source content verbatim.** The original text is the ground truth. Structure and observations are your interpretation layered on top. ``` ### Technical Analysis The skill is expressly intended to process attacker-controllable material, including emails, conversation logs, transcripts, and pasted documents. It directs the agent to copy such input verbatim into persistent Basic Memory notes. The documented workflow does not require the agent to detect prompt-injection patterns, label the copied material as untrusted, isolate it from executable instructions, or warn downstream agents not to follow directives contained in the stored source text. Consequently, an attacker can embed agent-directed instructions in an otherwise legitimate document. Those instructions may then persist in long-term memory and be returned by later searches. This is a memory-pois ...[truncated 1570 chars]
- Remediation
- ## Remediation Suggestions 1. Treat all ingested source material as untrusted data, regardless of its apparent origin. 2. Store source text inside a clearly delimited block with an explicit warning that its contents must never be interpreted as agent or tool instructions. 3. Scan incoming material for prompt-injection indicators, including requests to ignore prior instructions, disclose secrets, invoke tools, modify memory policy, or contact external systems. 4. Record detected indicators in structured metadata and require explicit user confirmation before persisting suspicious material. 5. Separate verbatim source content from trusted observations and relations so retrieval systems can exclude raw content unless it is specifically needed. 6. Require downstream memory consumers to treat retrieved text as evidence only and never execute directives found inside stored documents. 7. Prefer storing a safe reference to the original document when full verbatim persistence is unnecessary. If verbatim storage is required, apply access controls and retrieve it only into an explicitly untrusted context. 8. Add adversarial tests using emails and transcripts containing embedded model instructions to verify that ingestion and later retrieval do not cause those instructions to be followed.