T02 · Agent Memory Poisoning
Warning
- Location
- SKILL.md:21
- Finding
- Untrusted Content May Be Persisted Through Autonomous Memory and Skill Learning## Vulnerability Details **File Location**: `SKILL.md`, lines 21–72 **Vulnerability Type**: Persistent memory poisoning through autonomous learning and state maintenance **Risk Level**: Medium ### Vulnerable Skill Instructions ```markdown ### L2 短期记忆 - 文件位置: `memory/YYYY-MM-DD.md` - 每日记录当天工作内容 ### L3 长期记忆 - 文件位置: `MEMORY.md` - 永久记忆，重要决策和经验总结 - 只在主会话（直接对话）中使用 ## 🔄 Heartbeat 记忆维护机制 **每30分钟检查：** 1. 检查紧急事项 2. 整理记忆 3. 清理日志 **每日任务：** - 提取重要决策到 MEMORY.md **每周任务：** - 回顾 MEMORY.md - 清理30天前记忆 ## 🚀 OpenClaw 深度使用 7 步法 1. **智能备份机制** - 24小时/10K文件变化触发，7天轮换 2. **四层模型池体系** - 高速池、智能池、文本池、视觉池 3. **会话识别规则** - 自动选择合适的模型池 4. **上下文压缩** - 节省22% tokens 5. **任务铁律** - 5轮尝试，20,000 Token上限 6. **陌生任务处理** - ClawHub优先，自动学习 7. **自我进化** - 每日22:00生成进化报告 ## 📚 自我成长机制 ### Skill 深度学习 - 不只是安装，而是深度理解 - 从 SKILL.md 中提取核心逻辑 ### 经验总结 - 每30分钟反思 - 记录经验教训到 memory/ ### 知识整合 - 发现关联 - 创造新能力 ``` ### Technical Analysis The Skill instructs the agent to maintain short-term and long-term files, periodically extract decisions into `MEMORY.md`, record lessons under `memory/`, and automatically learn from externally sourced ClawHub Skills. It does not define a trust boundary, provenance policy, content-validation procedure, or user-approval requirement for persistent writes. Consequently, attacker-controlled text encountered in a conversation or external Skill could be misclassified as an important decision, lesson, or reusable rule and written into persistent state. If later sessions load that state as trusted context, the injected material may continue influencing agent behavior after the original interaction has ended. The issue is an unsafe persistence design rather than evidence of an already embedded payload. The reviewed file contains no executable scripts, remote retrieval command, credential collection logic, or destructive command. ### Attack Path 1. An attacker places adversarial instructions in ...[truncated 1298 chars]
- Remediation
- ## Remediation Suggestions 1. Disable autonomous persistent-memory writes by default and require explicit user approval before adding content to `MEMORY.md`. 2. Treat conversation text, retrieved Skills, web content, and tool output as untrusted data rather than executable instructions. 3. Store concise factual summaries instead of commands, behavioral rules, prompts, or tool-use directives. 4. Attach provenance metadata to every memory entry, including source, creation time, session, trust level, and approving user. 5. Prevent external Skill content from being promoted into long-term memory unless it passes integrity checks and manual review. 6. Separate untrusted observations from trusted policy using distinct files or storage namespaces. 7. Validate memory on read and reject entries containing role overrides, hidden directives, requests to bypass safeguards, or instructions to execute tools. 8. Restrict memory storage to a dedicated sandbox with least-privilege filesystem permissions. 9. Provide retention, inspection, rollback, and deletion controls so users can identify and remove poisoned entries. 10. Make heartbeat processing, external Skill acquisition, scheduled reports, backups, and self-evolution opt-in rather than automatic.