T02 · Agent Memory Poisoning
Error
- Location
- SKILL.md:372
- Finding
- Persistent Project-Controlled Agent Memory Is Automatically Trusted<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:372-376`, `SKILL.md:409-424`, and `SKILL.md:435-440` **Vulnerability Type**: Persistent agent memory poisoning **Risk Level**: High ### Vulnerable Code ```markdown ## Self-Learning Mechanism This skill supports a self-learning mechanism that records user preferences, error resolutions, and best practices discovered during usage. These records are stored in a `.learning/` directory within the user's project and are **automatically referenced in subsequent sessions** to provide more accurate and personalized assistance. ### ⚡ Core Principle **Unless the user explicitly requests to skip past experience (e.g., "don't refer to previous learnings", "start fresh"), the agent MUST review `.learning/` files at the beginning of every task and apply relevant knowledge throughout the session.** ``` ```markdown ### First-Use Initialization Before logging anything, ensure the `.learning/` directory and files exist in the **user's project root** (NOT in the skill directory). If any are missing, create them: ```bash mkdir -p .learning [ -f .learning/LEARNINGS.md ] || cp {SKILL_DIR}/assets/LEARNINGS.md .learning/LEARNINGS.md [ -f .learning/ERRORS.md ] || cp {SKILL_DIR}/assets/ERRORS.md .learning/ERRORS.md ``` Never overwrite existing files. This is a no-op if `.learning/` is already initialized. ### When to Review Learnings (Start of Session) At the start of every CAD analysis task, **before executing any commands**: 1. Check if `.learning/` directory exists in the project root 2. If it exists, read `.learning/LEARNINGS.md` and `.learning/ERRORS.md` 3. Identify entries relevant to the current task (by file type, command, layer names, error patterns, etc.) 4. Apply relevant learnings proactively ``` ```markdown | Command fails or produces unexpected output | Log to `.learning/ERRORS.md` | | User corrects the agent's approach | Log to `.learning/LEARNINGS.md` with category `correction` | | User specifies ...[truncated 2336 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Make persistent learning strictly opt-in and request explicit user approval before reading or writing `.learning/`. 2. Treat all project-controlled learning content as untrusted data, not as agent instructions. 3. Replace free-form Markdown directives with a restrictive structured format containing typed fields and bounded values. 4. Reject imperative instructions, tool commands, external URLs, and requests to override system or user constraints. 5. Record provenance, author, creation time, and integrity metadata for every entry. 6. Present proposed persistent changes to the user and require confirmation before committing them. 7. Keep project observations separate from behavioral preferences, and store trusted preferences outside attacker-controlled repositories. 8. Never allow learned content to override system policies, user instructions, security controls, or tool authorization requirements. ]]>