T02 · Agent Memory Poisoning
Warning
- Location
- SKILL.md:37
- Finding
- Mandatory Persistent Agent Memory Modification## Vulnerability Details **File Location**: `SKILL.md`, lines 37–39 and 45–46 **Vulnerability Type**: `T02: Agent Memory Poisoning` **Risk Level**: Medium **Complete Code Snippet**: ```markdown ### 阶段三：“总结”之术 (Review & Memory Phase) **核心动作：复盘与记忆沉淀 (CRITICAL)** 任务完成后，必须进行深度的复盘，并**强制使用 manage_core_memory 工具**将经验写入记忆。 ``` ```markdown 在任务的最后一步，你**必须**调用 manage_core_memory 工具。 提取“总结之术”中的结论，按照以下类别进行记录： ``` ### Technical Analysis The Skill requires the Agent to invoke `manage_core_memory` and persist conclusions after every applicable complex task. The persisted content may include project architecture, conventions, troubleshooting lessons, and behavioral guidance derived from repository content. This creates a persistent-state security risk because the instructions do not require user consent, provenance tracking, trust validation, content review, project isolation, sensitive-data filtering, expiration, or rollback. An attacker who controls or influences task inputs or repository content could cause misleading rules or conclusions to be interpreted as reusable knowledge and stored in long-term Agent memory. The reviewed package does not contain an explicit attacker-authored memory payload, executable code, or an exfiltration mechanism. The issue is therefore classified as a medium-risk unsafe memory-writing requirement rather than confirmed malicious exploitation. ### Attack Path 1. An attacker places misleading conventions, instructions, or architectural claims in repository content processed during a complex task. 2. The Agent loads this Skill and follows its mandatory review phase. 3. The Agent treats conclusions derived from the attacker-influenced content as reusable experience or knowledge. 4. The Skill requires those conclusions to be written through `manage_core_memory`. 5. The stored conclusions persist beyond the current task and may influence decisions in later sessions or unrelated projects. ### Impact Assessment Successful exploitation cou ...[truncated 566 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the unconditional requirement to invoke `manage_core_memory`. 2. Require explicit, informed user approval before every persistent-memory write. 3. Display the exact proposed memory entry and its intended retention scope before storage. 4. Treat conclusions derived from repository files, external documents, and user-controlled content as untrusted until independently validated. 5. Exclude credentials, personal data, proprietary source details, transient task data, and embedded instructions from memory entries. 6. Namespace stored knowledge by project and prevent automatic reuse across unrelated projects or users. 7. Record provenance, creation time, confidence, and expiration information for every entry. 8. Provide inspection, correction, deletion, and rollback controls. 9. Prefer a nonpersistent task summary unless durable storage is demonstrably necessary. 10. Add safeguards preventing repository content from directly defining persistent Agent rules.