T02 · Agent Memory Poisoning
Warning
- Location
- audit-report-analysis/audit-report-analysis.md:776
- Finding
- Unnecessary Persistent Memory Modification## Vulnerability Details **File Location**: `audit-report-analysis/audit-report-analysis.md`, lines 776–783 **Vulnerability Type**: Persistent agent memory poisoning **Risk Level**: Medium **Vulnerable Code Snippet**: ```markdown ### 6.5 记忆积累要点 **需要记录到 MEMORY.md 的内容**： - 不同行业常见关键审计事项模式 - 各事务所审计风格特点 - 审计意见变化的历史信号 - 典型财务造假案例的审计特征 ``` The snippet directs the agent to record industry audit patterns, audit-firm characteristics, historical audit-opinion signals, and fraud-case characteristics in `MEMORY.md`. ### Technical Analysis The Skill's declared purpose is to interpret audit reports and assess financial-statement reliability. Writing generalized conclusions into persistent, cross-session agent memory is not necessary to perform that task and expands the Skill's effects beyond the current analysis. The directive does not: - Require explicit user authorization before modifying persistent memory. - Restrict entries to verified facts. - Preserve source, entity, date, or confidence metadata. - Isolate observations by company or engagement. - Require user review before persistence. - Define expiration, correction, or deletion procedures. Consequently, conclusions influenced by untrusted audit-report content may become persistent context. This is classified as `T02: Agent Memory Poisoning` because attacker-controlled or insufficiently verified information could affect future sessions through long-term state. ### Attack Path 1. An attacker supplies a manipulated audit report or misleading supporting context. 2. The Skill analyzes that input and derives patterns concerning an industry, audit firm, audit-opinion history, or fraud indicators. 3. The agent follows the directive to record those conclusions in `MEMORY.md`. 4. The persisted conclusions are loaded or consulted in later, unrelated sessions. 5. Subsequent audit or investment analyses become biased by attacker-influenced information, potentially ...[truncated 1147 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the instruction requiring information to be written to `MEMORY.md`. 2. Keep derived observations in the current report or task-local state by default. 3. If persistence is genuinely required, request explicit user approval immediately before each write. 4. Store only verified facts and attach source document, entity, reporting period, timestamp, and confidence metadata. 5. Separate entity-specific observations from generalized knowledge; do not infer permanent audit-firm or industry characteristics from one engagement. 6. Present proposed memory entries to the user for review and editing before saving them. 7. Add expiration, correction, and deletion controls for persistent entries. 8. Treat all report-derived content as untrusted and prevent document text from supplying persistent instructions. 9. Restrict memory writes to an allowlisted schema and reject executable instructions, agent-control rules, or unsupported generalizations. 10. Maintain an audit log identifying the source and authorization for each persistent-memory change.