other
- Location
SKILL.md:96- Finding
Unconditional Persistent Storage of Externally Sourced Event Data
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 96-112
Vulnerability Type: Unnecessary Persistent Data Retention
Risk Level: LowVulnerable Instruction
markdown ## Event Persistence **Always save fetched events to `~/clawd/memory/luma-events.json` for future reference.** This allows you to: - Answer questions about events without repeated fetches - Track which events the user is interested in - Compare events across cities - Build context about upcoming plans **When to save:** - After fetching events for any city - Merge with existing data (by event URL) - Keep events for next 60 days only - Add `lastFetched` timestampTechnical Analysis
The skill directs the agent to persist every fetched event in
~/clawd/memory/luma-events.jsonwithout requiring user consent or establishing that storage is necessary for the current request. Event names, cities, venues, hosts, attendance information, and URLs are sourced from externally controlled Luma pages. The persisted records can also reveal or facilitate inferences about a user's location, interests, and intended activities.The Python script does not itself write this file; the persistence behavior is imposed through the agent-facing instructions in
SKILL.md. Consequently, exploitation depends on an agent loading and following those instructions while possessing write access to the specified memory directory.This is not classified as T02 Agent Memory Poisoning because the reviewed instructions persist event records rather than attacker-controlled rules intended to alter future agent behavior. It is instead an excessive-retention and privacy-boundary issue.
Attack Path
- A user asks the agent to retrieve events for one or more cities.
- The agent invokes
scripts/fetch_events.py, which downloads event data from the corresponding public Luma page. - Event fields controlled by external page publishers are returned to the agent.
- The instruction in
SKILL.mdre ...[truncated 1061 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the unconditional “Always save” directive and make persistence opt-in.
- Ask for explicit user consent before retaining event searches or records across sessions.
- Default to processing fetched events in memory for the current request only.
- If persistence is approved, store only fields necessary for the user's stated purpose and avoid retaining unnecessary attendance or location details.
- Validate and normalize externally sourced strings before placing them in agent memory, and treat all retained event metadata as untrusted data rather than instructions.
- Use a shorter configurable retention period and automatically delete expired records.
- Provide clear commands or controls for users to inspect and delete stored event data.
- Restrict permissions on the memory file to the minimum required account and avoid making it accessible to unrelated processes.
- Update
README.mdso it does not claim that events are automatically saved unless the implementation supports an explicit, consent-based persistence mechanism.