T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:167- Finding
Persistent Agent Memory Poisoning Through Unvalidated Learning Records and Self-Modification Instructions
- Content
View full analysis
1 else True rec = (sys.argv[2] if len(sys.argv) > 2 else "") print(json.dumps(record(ok, rec), ensure_ascii=False)) ``` The relevant Skill instructions state that: - `learned_patterns.json` stores operation statistics, error patterns, user preferences, and improvement suggestions. - Important user preferences are to be written to that file and adopted on later invocations. - After three accumulated errors, learned experience is to be written back into `SKILL.md`. ### Technical Analysis The `record()` function accepts an unrestricted string in `note` and appends it directly to persistent JSON storage. It applies no schema validation, length restriction, content classification, user scoping, or distinction between descriptive data and executable behavioral instructions. This would be ordinary unsafe persistence if the values were only displayed as data. However, the surrounding Skill instructions explicitly require later executions to apply stored preferences and direct the Agent to promote accumulated experience into the governing `SKILL.md`. This creates a trust-boundary violation: text originating in a user interaction can move from un ...[truncated 1744 chars]- Remediation
View remediation