T02 · Agent Memory Poisoning
Warning
- Location
- SKILL.md:84
- Finding
- Persistent Agent Behavior Modification Through Workspace Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 84–92 **Vulnerability Type**: Persistent agent memory poisoning **Risk Level**: Medium ### Vulnerable Code ```markdown ## Loading AURA at Startup Add to your AGENTS.md: ```markdown ## Personality If AURA.yaml exists in workspace, read it at session start and apply the personality traits to all responses. ``` ``` ### Technical Analysis The Skill recommends modifying `AGENTS.md`, a persistent workspace instruction file, so that the agent reads `AURA.yaml` at every session startup and applies its contents to all responses. This establishes `AURA.yaml` as a persistent behavior-control channel. The documented loading process does not require strict schema validation, rejection of unknown keys, trusted-file ownership checks, or separation of configuration values from executable natural-language instructions. Consequently, a party with workspace write access could replace or alter `AURA.yaml` and attempt to introduce behavior-changing content that affects future, unrelated sessions. The persistence is intentional at the personality level, but storing the loader rule in `AGENTS.md` broadens the effect beyond the invocation that configured AURA and creates the memory-poisoning risk. ### Attack Path 1. A user or agent follows the Skill and adds the supplied startup-loading rule to `AGENTS.md`. 2. An attacker, compromised tool, or untrusted project contributor obtains write access to the workspace. 3. The attacker creates or modifies `AURA.yaml`, adding manipulated values or instruction-like content outside the intended personality schema. 4. A subsequent agent session reads `AGENTS.md` during initialization. 5. The persistent rule causes the agent to load the attacker-controlled `AURA.yaml`. 6. If the file is treated as behavioral instructions rather than strictly validated data, the malicious content influences responses and decisions across subsequent sessions. This path requires the at ...[truncated 721 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Do not instruct the Skill to modify persistent agent-control files such as `AGENTS.md` by default. 2. Load the personality profile only when the user explicitly invokes the Skill, or scope it to the current session unless persistent behavior is separately confirmed. 3. Parse `AURA.yaml` as structured data using a strict schema: - Permit only documented fields. - Require the expected numeric and Boolean types. - Enforce numeric ranges from 1 through 10. - Reject unknown keys, nested instruction fields, tags, aliases, and free-form directives. 4. Treat all profile values as inert configuration data, never as natural-language instructions. 5. Before enabling persistence, display the exact file path, duration, affected sessions, and configuration values, and require explicit user approval. 6. Verify that the profile resides within the expected workspace root and is not a symbolic link to another location. 7. Warn when `AURA.yaml` changes after approval and require reauthorization before loading the modified profile. 8. Provide a reset operation that removes both `AURA.yaml` and any AURA-related startup rule previously inserted into `AGENTS.md`. ]]>