T02 · Agent Memory Poisoning
- Location
SKILL.md:114- Finding
Untrusted External Content Is Persisted Verbatim Without Prompt-Injection Controls
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 39 and 114–131; the unsafe behavior is reiterated at line 302
Vulnerability Type: Persistent indirect prompt injection through memory ingestion
Risk Level: MediumRelevant Code Snippet:
markdown Don't rewrite or summarize the source content. Preserve it verbatim in the note — you'll add structured observations alongside it.python # Lines 114–131 Create the primary note for the ingested content. This is the "record of what happened" — it preserves the raw material and adds structured metadata. ### Meeting / Conversation Note write_note( title="NovaTech Meeting - Jordan Rivera - Feb 22, 2026", directory="meetings/2026", note_type="meeting", tags=["meeting", "novatech", "federated-learning"], metadata={"date": "2026-02-22"}, content=""" # NovaTech Meeting - Jordan Rivera - Feb 22, 2026 Brief one-sentence summary of what this meeting was about. ## Transcript [Preserve all source content verbatim — do not summarize or rewrite]markdown - **Preserve source content verbatim.** The original text is the ground truth. Structure and observations are your interpretation layered on top.Technical Analysis
The skill is expressly intended to process attacker-controllable material, including emails, conversation logs, transcripts, and pasted documents. It directs the agent to copy such input verbatim into persistent Basic Memory notes.
The documented workflow does not require the agent to detect prompt-injection patterns, label the copied material as untrusted, isolate it from executable instructions, or warn downstream agents not to follow directives contained in the stored source text. Consequently, an attacker can embed agent-directed instructions in an otherwise legitimate document. Those instructions may then persist in long-term memory and be returned by later searches.
This is a memory-pois ...[truncated 1570 chars]
- Remediation
View remediation
Remediation Suggestions
- Treat all ingested source material as untrusted data, regardless of its apparent origin.
- Store source text inside a clearly delimited block with an explicit warning that its contents must never be interpreted as agent or tool instructions.
- Scan incoming material for prompt-injection indicators, including requests to ignore prior instructions, disclose secrets, invoke tools, modify memory policy, or contact external systems.
- Record detected indicators in structured metadata and require explicit user confirmation before persisting suspicious material.
- Separate verbatim source content from trusted observations and relations so retrieval systems can exclude raw content unless it is specifically needed.
- Require downstream memory consumers to treat retrieved text as evidence only and never execute directives found inside stored documents.
- Prefer storing a safe reference to the original document when full verbatim persistence is unnecessary. If verbatim storage is required, apply access controls and retrieve it only into an explicitly untrusted context.
- Add adversarial tests using emails and transcripts containing embedded model instructions to verify that ingestion and later retrieval do not cause those instructions to be followed.