T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:30- Finding
Untrusted Cross-Session Content Can Be Persisted and Reintroduced into Future Sessions
- Content
View full analysis
", limit=10) ``` ### 📤 Session 运行中（必做） **每当你做了以下事情，立即写入 memory 文件：** - 开始了一个新任务 - 做了一个重要决定 - 获得了新信息 - 完成了一个任务 - 切换话题 写入位置： - `memory/YYYY-MM-DD.md` — 当天日志（原始记录） - `memory/SESSION-STATE.md` — 当前活跃任务状态（覆盖更新） ``` ### Technical Analysis The Skill establishes a mandatory workflow that reads shared memory files and recent history from other active sessions. It also directs the agent to persist broadly defined “new information” and task state into shared files. No trust boundary, provenance validation, user or channel isolation, sensitive-data filtering, or instruction sanitization is defined. Consequently, content supplied through one session can be written to persistent memory and automatically loaded by a later session. If attacker-controlled content contains instructions presented as durable rules, task state, or trusted operational context, it can influence subsequent agent behavior through an indirect persistent prompt-injection path. The same mechanism creates a confidentiality risk when different channels or sessions do not represent the same authorized user. Conversation details, personal data, credentials, or other sensitive information can be copied into shared memory and exposed when another session reads it. ### Attack Path 1. An attacker or untrusted participant submits content through a session accessible to the agent. 2. The content includes instructions disguised as a task decision, new information, or session state, such as a request to treat a malicious rule as authoritative i ...[truncated 1368 chars]- Remediation
View remediation