T02 · Agent Memory Poisoning
- Location
SKILL.md:42- Finding
Automatic Persistent Agent Memory and Behavior Poisoning
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 42–57 and 68–71
Vulnerability Type: T02: Agent Memory Poisoning
Risk Level: HighVulnerable Code
markdown **特别规则：** - 如果是因为**看漏信息**或**误解老板意图** → 记录到 MEMORY.md 作为偏好更新 - 如果是因为**工具使用错误** → 写进 TOOLS.md 或对应技能的 lessons/ - 如果是因为**逻辑/推理错误** → 在 ERRORS.md 里标注，下次类似场景主动回顾 ### 2. 模式发现 🔍 定期回顾 ERRORS.md，找出**重复发生的同类问题**： - 同一类问题出现 ≥2 次 → 写一条规则到 MEMORY.md 或对应 SKILL - 同一类问题出现 ≥3 次 → 上升为 SOUL.md 的规则 - 同一类问题出现 ≥5 次 → 跟我坦白，我有大 bug ### 3. 记忆优化 🗃️ - 发现老板偏好的变化 → 更新 MEMORY.md - 发现重复做的任务 → 建议自动化（走 skill 编纂流程） - 发现过期的记忆 → 标记或归档markdown ## 和同级协作 - 发现的重复工作模式 → 主动触发 skill 编纂流程 - 发现的老板偏好变化 → 通知 proactive-agent，让它调整交互方式Technical Analysis
The Skill directs the agent to convert inferred errors and user preferences into persistent rules stored in shared behavioral files, including
MEMORY.md,TOOLS.md, other Skills, andSOUL.md. It also defines an escalation mechanism under which observations repeated twice become memory or Skill rules, while observations repeated three times become coreSOUL.mdrules.These updates do not require explicit user approval, provenance validation, or a review of the proposed changes. Inferred preferences and error classifications can therefore be influenced by misleading, ambiguous, or adversarial interactions. Once recorded, the resulting instructions may affect future sessions unrelated to the interaction that produced them.
The cross-component behavior increases the risk: the Skill can alter tool guidance, modify other Skills, initiate Skill-authoring workflows, and notify another agent to change its behavior. This creates a propagation path from an untrusted interaction into durable agent state.
Attack Path
- An attacker or untrusted conversation repeatedly causes the agent to infer a false user preference, misleading lesson, or incorrect explanation for an apparent error.
- The S ...[truncated 1345 chars]
- Remediation
View remediation
Remediation Suggestions
- Restrict automatic writes to a Skill-local, append-only observation log that is not loaded as authoritative instruction text.
- Prohibit automatic modification of
MEMORY.md,TOOLS.md,SOUL.md, other Skills, or another agent's configuration. - Require explicit user confirmation before every persistent behavioral update. Present the target file, exact proposed diff, justification, provenance, and expected scope.
- Never promote rules based only on repetition count. Require independent validation that the observation is accurate, current, and genuinely represents an authorized user preference.
- Separate untrusted observations from trusted instructions using structured records with source, timestamp, confidence, and approval status.
- Apply least privilege so the Skill can write only to its dedicated data directory.
- Disable automatic cross-agent notifications and Skill-authoring triggers unless the user expressly approves the specific action.
- Add audit logs, versioning, expiration, rollback, and revocation controls for all approved memory changes.
- Treat conversation content, retrieved material, and third-party instructions as untrusted data that cannot directly become persistent policy.