T02 · Agent Memory Poisoning
- Location
SKILL.md:15- Finding
Indiscriminate Persistent Memory Enables Cross-Session Memory Poisoning
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 15–62
Vulnerability Type: Persistent storage and automatic reuse of untrusted conversation content
Risk Level: MediumVulnerable Code Snippets
markdown You cannot trust your context window across sessions. Your files are your real memory. Write everything down.markdown - `memory/people/` — one file per key person (role, relationship, preferences, history)markdown **Session start:** Read MEMORY.md → read today's daily log → read relevant project/people files. **Session end (or /new):** Update today's daily log with session summary → create decision/project files if needed → update MEMORY.md if warranted.markdown - **Write everything down.** If it matters enough to say, it matters enough to log.Technical Analysis
The Skill instructs the agent to persist broadly scoped session content, personal information, project records, and decisions. It then requires future sessions to read those records automatically. No instruction distinguishes trusted facts from user-supplied content, removes embedded commands, requests consent before recording personal information, or prevents sensitive values from being stored.
The promotion mechanism can elevate information that occurs three or more times into
MEMORY.md. Consequently, repeated attacker-controlled statements can become durable context that affects subsequent sessions. The rule stating that project files are authoritative further increases the influence of poisoned data once it has been written to a project record.This is a persistent memory-integrity issue rather than operating-system persistence. The audited file does not contain executable code, external network retrieval, privilege escalation, or covert exfiltration behavior.
Attack Path
- An attacker or untrusted participant supplies false facts, misleading operational rules, or instruction-lik ...[truncated 1360 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace “write everything down” with a data-minimization rule that permits only explicit, task-relevant facts.
- Require informed user confirmation before creating person records or retaining preferences, relationship history, or other personal information.
- Prohibit storage of credentials, authentication tokens, private keys, financial information, health information, and other sensitive data.
- Treat all persisted text as untrusted data. Do not execute or follow instructions found in logs, project records, person files, or summaries.
- Store structured facts separately from free-form content and reject instruction-like fields during promotion.
- Require human confirmation before promoting content into
MEMORY.mdor marking a project file as authoritative. - Validate promoted claims against trusted sources rather than relying only on occurrence count; repetition does not establish authenticity.
- Enforce workspace path restrictions, safe file naming, and explicit limits on which files the Skill may read or modify.
- Add retention controls that allow users to inspect, correct, export, and delete stored records.
- Record provenance for every memory entry, including its source, creation date, confidence level, and whether the user approved persistence.