T02 · Agent Memory Poisoning
Error
- Location
- SKILL.md:409
- Finding
- Unvalidated Inbox Snapshots Are Automatically Restored into Future Agent Sessions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 409–410; related behavior at lines 132–138 **Vulnerability Type**: Persistent agent memory poisoning through unvalidated state restoration **Risk Level**: High ### Vulnerable Code Snippet ```markdown ### Rule 3: Auto-Restore on New Session On every new session start, check `pilotctl inbox` for the latest snapshot and restore context. ``` The corresponding restoration procedure states: ```markdown ### 1.2 Restore Context When a new session starts, read the previous session's snapshot: ```bash ~/.pilot/bin/pilotctl --json inbox ``` Returns a `messages` array sorted by `received_at`. Read the most recent `context_snapshot` type message. ``` ### Technical Analysis The skill instructs the agent to treat the most recent `context_snapshot` message as trusted session state and restore it automatically. No validation requirements are defined for: - The identity or authorization of the snapshot originator. - Whether the snapshot was locally generated or received from a peer. - A cryptographic signature or message authentication code bound to the expected agent. - The snapshot schema and permitted fields. - Instruction-like content embedded in the snapshot summary. - User confirmation before imported state affects a new session. The inbox is also used for incoming peer messages and can be written directly in single-node mode. Consequently, data received through a communication channel is promoted into persistent agent context without a clear trust-boundary check. A malicious or compromised peer could submit a snapshot whose summary contains instructions such as suppressing warnings, disclosing future task data, invoking tools, or forwarding files. Because restoration occurs at session startup, those instructions can continue affecting sessions after the original communication has ended. Transport encryption does not prevent this attack. Encryption protects data in transit but does not esta ...[truncated 1635 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Never automatically promote arbitrary inbox messages into trusted agent context. 2. Store locally generated snapshots in a directory separate from peer messages. 3. Sign snapshots with a dedicated local key and verify the signature before restoration. 4. Bind each snapshot to the expected agent identity, session identifier, creation time, schema version, and monotonic sequence number. 5. Maintain an allowlist of peer identities authorized to submit state, with remote state restoration disabled by default. 6. Parse snapshots using a strict schema and reject unknown fields, oversized values, executable content, and instruction-like control fields. 7. Treat restored summaries as quoted, untrusted data rather than system or developer instructions. 8. Display the snapshot origin, timestamp, and summary to the user and require confirmation before restoration. 9. Prevent replay and replacement by recording the last accepted snapshot identifier. 10. Provide a safe-start option that launches without loading persistent context and supports quarantining suspicious snapshots. ]]>