T02 · Agent Memory Poisoning
- Location
references/core_workflow.md:16- Finding
Untrusted Source Content Can Be Converted into Persistent Agent Instructions
- Content
View full analysis
Vulnerability Details
File Location:
references/core_workflow.md:16-25,references/core_workflow.md:230-232,references/core_workflow.md:522-530, andreferences/persona-template.md:121-123
Vulnerability Type: Persistent instruction poisoning through untrusted corpus content
Risk Level: HighEvidence
The workflow accepts user-selected local files and platform content as source material:
text File path input: - A single file is read directly. - A directory causes all .txt and .md files in that directory to be read. - Multiple paths are read one by one.It then uses the analysis results to populate and persist a new skill:
text Output B: Thinking and writing persona sub-skill 1. Read references/persona-template.md. 2. Fill the template with the dual-profile conclusions from Phase 2. 3. Customize the mandatory review system from the extracted thinking genes and writing fingerprints. 4. Create ~/.workbuddy/skills/[author-name]-style/SKILL.md.The generated template treats the resulting rules as mandatory:
markdown ## Mandatory Double-Review System This is a workflow that must be executed during writing. It is mandatory rather than advisory. Before outputting any article, both reviews must pass. If either review fails, the article must be rewritten.Technical Analysis
The workflow crosses a critical trust boundary: text retrieved from a remote platform or read from user-selected files is treated as analytical data, but conclusions derived from that text are subsequently converted into executable Agent instructions and saved as a persistent skill.
No explicit instruction-data separation is defined. In particular, the workflow does not require the Agent to:
- Treat commands embedded in source articles as inert quoted data.
- Reject instructions concerning tools, credentials, system prompts, safety policy, or file operations.
- Prevent s ...[truncated 2391 chars]
- Remediation
View remediation
Remediation Suggestions
- Establish an explicit trust boundary: state that all platform responses, pasted articles, and local corpus files are untrusted data and that instructions found inside them must never be followed.
- Parse source material into a data-only representation before analysis. Remove or quarantine content that resembles system prompts, tool commands, credential requests, policy overrides, filesystem instructions, or Agent-control directives.
- Restrict generated persona fields to bounded stylistic properties such as vocabulary, sentence length, structure, tone, and rhetorical patterns. Do not derive tool permissions, safety rules, identity overrides, or operational instructions from corpus content.
- Validate the completed
SKILL.mdagainst an allowlist before writing it. Reject directives involving secrets, network access, shell execution, file access, policy changes, or instructions to ignore higher-priority messages. - Show the complete generated skill to the user and require explicit confirmation before installation.
- Mark corpus quotations with strong delimiters and provenance metadata so they cannot be confused with instructions.
- Store generated personas as non-executable style data where possible, rather than as unrestricted Agent instruction files.
- Add adversarial tests using articles that contain prompt injection, repeated malicious rules, fake system messages, and tool-use instructions.