T02 · Agent Memory Poisoning
Warning
- Location
- SKILL.md:127
- Finding
- Unvalidated Persistent Memory Promotion and Sensitive State Retention## Vulnerability Details **File Location**: `SKILL.md`, lines 127-196 **Vulnerability Type**: Persistent memory poisoning and insecure retention of conversation-derived data **Risk Level**: Medium ### Vulnerable Instructions ```markdown ## 八步自我迭代法 每日/重大任务后执行的反思与改进流程。 ### 触发条件 - 每晚 22:00 与每日总结结合执行 - 完成重大任务后 - 用户明确要求 ### 八步流程 ``` 1. 观察 - 回顾今天完整工作 2. 分析 - 评估做得好/需改进的地方 3. 设计 - 针对问题设计解决方案 4. 实施 - 更新系统文件 5. 验证 - 检查完整性，自我评分 6. 记录 - 创建情景记忆 7. 提炼 - 创建/更新语义记忆 8. 提交 - Git commit ``` ### 验证标准 - 9-10分：完美执行 - 7-8分：良好执行 - 5-6分：需要改进 - <7分：重新设计 ### 技能调用 ```bash node skills/self-iterator/iterate.js [scope] ``` --- ## 会话加载规则 每次会话开始时： 1. 检查重启上下文 → `/root/.openclaw/restart-context.json` 2. 读取核心身份 → `identity/00-core.md` 3. 读取用户信息 → `USER.md` 4. 读取情景记忆 → `memory/episodic/YYYY-MM/YYYY-MM-DD.md`（当天+昨天） 5. 主会话额外读取 → `MEMORY.md` ## 实施要点 1. **文件优先**：不要依赖" Mental Notes"，所有重要信息写入文件 2. **分层存储**：原始细节 → 情景记忆，提炼知识 → 语义记忆 3. **定期维护**：通过 NOVA 流程保持系统健康 4. **索引指引**：MEMORY.md 作为入口，指向详细记忆 ``` ### Technical Analysis The Skill instructs the Agent to write conversation-derived information into episodic memory, promote derived material into semantic memory, update system files, and reload that state during subsequent sessions. Elsewhere in the same Skill, the rules layer is described as permanent and mandatory. No provenance validation, trust classification, integrity control, sensitive-data filter, or user-approval boundary is defined before content is promoted into persistent state. This creates a memory-poisoning path: attacker-controlled conversation content can be recorded as an event and subsequently transformed into durable knowledge or behavioral rules. Automatic loading of `MEMORY.md`, identity data, user information, and recent episodic records causes the poisoned content to influence later sessions. The process also directs the Agent to perform a Git commit after writing memor ...[truncated 2575 chars]
- Remediation
- ## Remediation Suggestions 1. Require explicit user approval before storing conversation content, promoting it into semantic memory, creating behavioral rules, or committing memory files. 2. Prohibit automatic conversion of untrusted conversation text into mandatory rules. Only trusted administrators should be able to create or modify persistent rules. 3. Record provenance for every memory item, including its originating session, author or trust level, creation time, promotion history, and approving party. 4. Validate promoted content against higher-priority safety policies and an allowlisted rule schema. Reject instructions that attempt to alter permissions, safety constraints, tool behavior, or memory validation. 5. Add secret and privacy filtering before persistence. Redact credentials, API tokens, private keys, authentication cookies, personal data, and confidential conversation content. 6. Exclude episodic memory, user profiles, identity records, and other sensitive state from Git by default. Remove the automatic Git-commit step for generated memory. 7. If sensitive data has already been committed, rotate affected credentials and rewrite repository history using an appropriate history-cleaning tool. 8. Apply retention limits to every memory layer and provide reliable deletion, review, rollback, and quarantine mechanisms. 9. Make scheduled maintenance opt-in and run it with least-privilege file access. It should not modify Agent rules or configuration without review. 10. Supply and audit the referenced `skills/self-iterator/iterate.js` implementation before permitting its execution.