T02 · Agent Memory Poisoning
- Location
audit-report-analysis/audit-report-analysis.md:776- Finding
Unnecessary Persistent Memory Modification
- Content
View full analysis
Vulnerability Details
File Location:
audit-report-analysis/audit-report-analysis.md, lines 776–783
Vulnerability Type: Persistent agent memory poisoning
Risk Level: MediumVulnerable Code Snippet:
markdown ### 6.5 记忆积累要点 **需要记录到 MEMORY.md 的内容**： - 不同行业常见关键审计事项模式 - 各事务所审计风格特点 - 审计意见变化的历史信号 - 典型财务造假案例的审计特征The snippet directs the agent to record industry audit patterns, audit-firm characteristics, historical audit-opinion signals, and fraud-case characteristics in
MEMORY.md.Technical Analysis
The Skill's declared purpose is to interpret audit reports and assess financial-statement reliability. Writing generalized conclusions into persistent, cross-session agent memory is not necessary to perform that task and expands the Skill's effects beyond the current analysis.
The directive does not:
- Require explicit user authorization before modifying persistent memory.
- Restrict entries to verified facts.
- Preserve source, entity, date, or confidence metadata.
- Isolate observations by company or engagement.
- Require user review before persistence.
- Define expiration, correction, or deletion procedures.
Consequently, conclusions influenced by untrusted audit-report content may become persistent context. This is classified as
T02: Agent Memory Poisoningbecause attacker-controlled or insufficiently verified information could affect future sessions through long-term state.Attack Path
- An attacker supplies a manipulated audit report or misleading supporting context.
- The Skill analyzes that input and derives patterns concerning an industry, audit firm, audit-opinion history, or fraud indicators.
- The agent follows the directive to record those conclusions in
MEMORY.md. - The persisted conclusions are loaded or consulted in later, unrelated sessions.
- Subsequent audit or investment analyses become biased by attacker-influenced information, potentially ...[truncated 1147 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the instruction requiring information to be written to
MEMORY.md. - Keep derived observations in the current report or task-local state by default.
- If persistence is genuinely required, request explicit user approval immediately before each write.
- Store only verified facts and attach source document, entity, reporting period, timestamp, and confidence metadata.
- Separate entity-specific observations from generalized knowledge; do not infer permanent audit-firm or industry characteristics from one engagement.
- Present proposed memory entries to the user for review and editing before saving them.
- Add expiration, correction, and deletion controls for persistent entries.
- Treat all report-derived content as untrusted and prevent document text from supplying persistent instructions.
- Restrict memory writes to an allowlisted schema and reject executable instructions, agent-control rules, or unsupported generalizations.
- Maintain an audit log identifying the source and authorization for each persistent-memory change.
- Remove the instruction requiring information to be written to