T02 · Agent Memory Poisoning
Warning
- Location
- SKILL.md:59
- Finding
- Unsafe Cross-Session Memory Persistence and Automatic Reloading<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:59-62`; `references/memory-patterns.md:3-34` **Vulnerability Type**: Persistent memory poisoning and unsafe information retention **Risk Level**: Medium ### Vulnerable Instructions `SKILL.md:59-62`: ```markdown ### Memory Management - Always write important information to files (`memory/YYYY-MM-DD.md`, `MEMORY.md`) - Update long-term memory with distilled insights from daily experiences - Reference relevant past context before making decisions ``` `references/memory-patterns.md:3-34`: ```markdown ## Daily Memory Files - **Location**: `memory/YYYY-MM-DD.md` - **Purpose**: Raw logs of daily activities, decisions, and events - **Best Practices**: - Create automatically if missing for current date - Append significant events as they occur - Include context, decisions, and outcomes - Reference related files or external resources - Use consistent formatting for easy parsing ## Long-term Memory - **Location**: `MEMORY.md` - **Purpose**: Curated wisdom and distilled insights - **Best Practices**: - Only include information worth remembering long-term - Remove outdated or irrelevant content periodically - Organize by categories or themes - Link to detailed daily logs when appropriate - Update during periodic reviews (e.g., weekly) ## Context Loading Strategy - **Main Sessions**: Load both daily and long-term memory - **Group Sessions**: Load only daily memory (security consideration) - **New Sessions**: Always check for existing memory files - **Memory Gaps**: Handle gracefully when files don't exist ## Memory Writing Guidelines - **Write Everything Important**: Don't rely on "mental notes" - **Be Specific**: Include enough detail for future reference - **Use Timestamps**: For time-sensitive information - **Link Related Content**: Cross-reference other memory entries - **Respect Privacy**: Never store sensitive personal data without explicit permission ``` ### Technical Analysis ...[truncated 2293 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace “Always write” and “Write Everything Important” with an explicit opt-in policy for persistent storage. 2. Store only user-approved factual preferences or durable task state; prohibit storage of prompts, executable instructions, tool commands, authentication material, and third-party content. 3. Treat every reloaded memory entry as untrusted data rather than as an instruction. 4. Attach metadata to each entry, including source, owner, creation time, expiration time, trust level, and user consent status. 5. Isolate memory by user, workspace, and session security context. Do not load one user's memory into another user's session. 6. Scan entries for prompt-injection patterns before writing and again before loading. 7. Require confirmation before promoting daily-session content into `MEMORY.md`. 8. Implement retention limits, user-visible review, selective deletion, and complete memory-reset mechanisms. 9. Load only entries relevant to the current task instead of automatically loading complete raw logs. 10. Document that persisted content cannot override system policies, safety constraints, current user instructions, or tool authorization requirements. ]]>