T02 · Agent Memory Poisoning
Error
- Location
scripts/reviewer.js:185- Finding
Fail-Open Security Review Allows Unreviewed Instructions to Persist in Other Skills
- Content
View full analysis
- Remediation
View remediation
/` only after a successful review. - Record an explicit approval status and reviewer version. 3. **Require positive approval during lifecycle loading** - Change `loadAllPatches()` so only units containing an explicit value such as `review_status: approved` are loaded. - Treat missing, unknown, failed, or pending review states as non-deployable. - Do not rely only on excluding `review_status: rejected`. 4. **Do not deploy unreviewed nursery units** - Require successful security review before nursery selection. - Consider requiring deterministic validation and at least one positive evidence event before persistent inlining. 5. **Add local deterministic security checks** - Reject prompt-override language, secret-access instructions, destructive command guidance, unexpected external URLs, and lifecycle marker manipulation. - Apply these checks independently of the LLM reviewer. - Normalize Unicode and Markdown before matching to reduce bypass opportunities. 6. **Use atomic activation** - Review the exact bytes that will be activated. - Atomically rename the approved file into the active directory. - Prevent content changes between review and deployment. 7. **Add regression tests** - Verify that network failures, malformed reviewer responses, missing credentials, timeouts, and file read failures never activate a unit. - Verify that units without explicit approval cannot be selected or written into `SKILL.md`. ]]>