T02 · Agent Memory Poisoning
Warning
- Location
scripts/learner.py:72- Finding
Persistent Agent Memory Poisoning Through Unvalidated Learning Data
- Content
View full analysis
Vulnerability Details
File Location:
scripts/learner.py:72-93; related behavioral instructions inSKILL.md:48-76
Vulnerability Type: Persistent storage of attacker-controlled preferences and operational notes
Risk Level: MediumVulnerable Code:
python def record_op(skill_dir, capability, success=True, error=None, note=None): data = load_learning(skill_dir) data["totalOps"] += 1 cap = data["capabilityStats"].setdefault(capability, {"count": 0, "success": 0, "fail": 0}) cap["count"] += 1 if success: cap["success"] += 1 else: cap["fail"] += 1 data["totalErrors"] += 1 if error: ep = data["errorPatterns"].setdefault(error, {"count": 0, "lastNote": "", "lastTime": ""}) ep["count"] += 1 ep["lastNote"] = note or "" ep["lastTime"] = data["lastUpdated"] or datetime.datetime.now().strftime("%Y-%m-%dT%H:%M") rec = {"t": data["lastUpdated"], "cap": capability, "ok": success, "err": error, "note": note} data["recentOps"].append(rec) data["recentOps"] = data["recentOps"][-20:] save_learning(skill_dir, data) return data def record_preference(skill_dir, key, value): data = load_learning(skill_dir) data["preferences"][key] = value save_learning(skill_dir, data) return dataThe reflection mechanism subsequently includes stored error names and notes in recommendations:
python def self_reflect(skill_dir): data = load_learning(skill_dir) suggestions = [] for err, info in data["errorPatterns"].items(): if info["count"] >= THRESHOLD_ERROR: suggestions.append( f"⚠️ 错误「{err}」已出现 {info['count']} 次，建议增加预检/兜底步骤，" f"并将经验回写本技能 SKILL.md（lastNote: {info.get('lastNote','')}）" )Technical Analysis
The
preferandrecordcommands accept arbitrary preference keys, pre ...[truncated 2697 chars]- Remediation
View remediation
Remediation Suggestions
- Treat every value loaded from
learned_patterns.jsonas untrusted data rather than an instruction. - Do not automatically apply stored preferences to later sessions. Require explicit user confirmation before a preference affects agent behavior.
- Remove the workflow that recommends directly writing accumulated notes or error content into
SKILL.md. - If Skill updates are necessary, generate a structured change proposal and require a trusted reviewer to approve the exact diff.
- Define strict schemas and allowlists for preference keys, capability names, and error types.
- Apply length limits and reject control sequences, markup, prompt directives, and multiline instruction-like content in stored values.
- Keep telemetry, user preferences, and executable agent instructions in separate files with separate trust boundaries.
- Render stored values as quoted data with clear provenance rather than interpolating them into authoritative recommendations.
- Record the origin and trust level of each entry and ignore untrusted entries when constructing agent context.
- Add tests proving that stored notes and preferences cannot modify system prompts, Skill instructions, tool permissions, or safety constraints.
- Treat every value loaded from