T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:176- Finding
Unvalidated Persistent Preferences Can Poison Future Agent Behavior
- Content
View full analysis
--key 输出语言 --val 中文 # 查看累计洞察（高频能力 / 反复错误） python scripts/learner.py insight <本技能目录> # 自动复盘（错误≥3次 或 操作≥10次 时给出改进建议） python scripts/learner.py reflect <本技能目录> ``` ```markdown ### 迭代规则 - **错误累计 ≥3 次** → 主动增加预检/兜底步骤，并将经验回写本 SKILL.md。 - **操作数 ≥10 次** → 分析高频能力优先打磨示例与质量，低频能力评估精简或合并。 - **重要用户偏好** → 写入 `learned_patterns.json`，下次调用直接采用，减少重复询问。 ``` The corresponding persistence implementation accepts arbitrary keys and values: ```python def record_preference(skill_dir, key, value): data = load_learning(skill_dir) data["preferences"][key] = value save_learning(skill_dir, data) return data ``` ### Technical Analysis The `prefer` command persists arbitrary command-line strings as preference keys and values. There is no schema, allowlist, length restriction, content validation, trust designation, or distinction between harmless presentation preferences and executable behavioral instructions. The skill documentation instructs the agent to apply stored preferences during later invocations. It also directs the agent to write accumulated experience back into `SKILL.md`. Although the Python helper does not itself edit `SKILL.md`, an agent following the documented workflow may promote untrusted runtime content into persistent skill-level instructions. This creates a memory-poisoning boundary failure: content originating from a user or product input can be stored as trusted state and subsequently influence unrelated sessions. ### Attack Path 1. An attacker submits an instruction-like value while presenting it as a user preference, error note, or optimization rule. 2. The agent invokes: ```bash python script ...[truncated 1217 chars]- Remediation
View remediation