T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:32- Finding
Untrusted Session Content Can Poison Persistent Agent Memory
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:32-35,SKILL.md:47-67, andscripts/auto_memory_keeper.py:120-134
Vulnerability Type: T02: Agent Memory Poisoning
Risk Level: MediumThe documented workflow collects recent session histories and stores selected message content in persistent daily memory files. It does not establish a trust boundary between user-approved facts and potentially attacker-controlled session text.
Vulnerable Code
SKILL.md:32-35:python # Use sessions_list to get active sessions in last 60 minutes # Use sessions_history to get session detailsSKILL.md:47-67:markdown **Step 4: Extract Key Info** From filtered messages, extract: | Type | Keywords | Format | |------|----------|--------| | **Decision** | "decided", "chose", "adopted" | - {time} {decision} | | **Task** | new feature, new config, new task | - {time} {task description} | | **Progress** | "completed", "finished", "installed" | - {time} completed {task} | | **Issue** | error, bug, failed | - {time} issue: {description} | | **Conclusion** | summary, conclusion, finding | - {time} {conclusion} | **Step 5: Smart Deduplication** Check for duplicates before recording: ```python # Read current file content # If similar content exists (>80% similarity), skip # Otherwise appendtext `scripts/auto_memory_keeper.py:120-134`: ```python def extract_key_info(message): """从消息中提取关键信息""" # 简单规则：提取动词+关键内容 patterns = [ (r'(安装|创建|添加|配置|设置|完成|修复|更新|修改|删除).*', '进展'), (r'(决定|选择|采用|使用|不要|拒绝).*', '决策'), (r'(问题|报错|错误|失败|bug).*', '问题'), (r'(总结|结论|发现|原来|其实).*', '结论'), ] for pattern, category in patterns: if re.search(pattern, message): return category, message return '事项', messageTechnical Analysis
The workflow treats recent session messages as candidates for dur ...[truncated 2560 chars]
- Remediation
View remediation
Remediation Suggestions
- Require explicit user confirmation before writing any session-derived content to persistent memory.
- Limit capture to messages explicitly marked for retention rather than automatically ingesting all recent session histories.
- Reject or quarantine content containing imperative instructions, role changes, tool-use directives, credential requests, or attempts to modify agent policies.
- Redact secrets and sensitive data, including tokens, passwords, private keys, personal information, and confidential conversation content.
- Store provenance metadata with every entry, including the source session, author role, capture time, and approval status.
- Treat stored entries as quoted, untrusted data rather than executable instructions when they are loaded in later sessions.
- Apply an allowlist of permitted memory categories and use structured fields instead of persisting raw message text.
- Separate unreviewed candidate memories from trusted long-term memory and promote entries only after validation.
- Add adversarial tests covering prompt injection, false decisions, secret-bearing messages, and instructions disguised as progress or conclusions.
- Ensure future cron or agent integration uses the same validation and approval controls before enabling automatic writes.