T02 · Agent Memory Poisoning
Warning
- Location
scripts/analyze_profile.py:756- Finding
Untrusted Archetype Configuration Can Poison Persistent Agent Instructions
- Content
View full analysis
Dict[str, Any]: """Load custom archetype definitions from YAML.""" try: import yaml with open(filepath, 'r') as f: data = yaml.safe_load(f) return data.get('archetypes', {}) except ImportError: print("Warning: PyYAML not installed. Using default archetypes only.") return {} except Exception as e: print(f"Warning: Could not load custom archetypes: {e}") return {} ``` ```python else: # prompt-snippet snippet = f"""## User Cognitive Profile - **Primary Archetype:** {profile['insights']['primary_mode']} - **Confidence:** {profile['insights']['primary_confidence']} - **Context Switching:** {profile['insights']['context_switching']} ### Communication Style """ for archetype in profile['archetypes']: rec = archetype['recommendations'] snippet += f""" **{archetype['name']}** ({archetype['metrics']['conversation_count']} conversations) - AI Role: {rec['ai_role']} - Style: {rec['communication_style']} - Keywords: {', '.join(archetype['keywords'][:5])} """ ``` The Skill documentation subsequently instructs users to add generated insights to persistent Agent configuration: ```markdown ### 3. Apply to Your Agent Add to your `SOUL.md` or `AGENTS.md`: ``` ### Technical Analysis `yaml.safe_load` prevents YAML from directly constructing arbitrary Python objects, but it does not establish that loaded strings are safe to use as Agent instructions. Custom archetype fields such as `name`, `ai_role`, and `description` can contain arbitrary multiline text. These val ...[truncated 2409 chars]- Remediation
View remediation