T02 · Agent Memory Poisoning
Error
- Location
- scheduler.py:451
- Finding
- Attacker-Controlled Task Content Is Persisted in Agent Memory## Vulnerability Details **File Location**: `scheduler.py:451-489` **Vulnerability Type**: Persistent agent-memory poisoning through unescaped user input **Risk Level**: High ### Vulnerable Code ```python def record_task_to_json(self, task: str, subagents: List[Dict], user_id: str, task_id: str, analysis: Dict): """记录任务到 JSON 文件（增强版）""" task_record = { "id": task_id, "task": task, "user_id": user_id, "created_at": datetime.now().isoformat(), "completed_at": None, "status": "running", "priority": analysis["priority"], "type": analysis["type"], "estimated_time": analysis["estimated_time"], "actual_time": None, "subagents": subagents, "quality_score": None, "feedback": [], } self.tasks_history.append(task_record) self.save_tasks_history() # 同时记录到每日 Memory 文件 today = datetime.now().strftime("%Y-%m-%d") memory_file = self.memory_path / f"{today}.md" if memory_file.exists(): content = memory_file.read_text(encoding='utf-8') else: content = f"# {today} 记忆\n\n" task_record_md = f""" ## 子 agent 任务 ### 📋 任务：{task[:50]}... - **任务 ID**: {task_id} - **创建时间**: {datetime.now().strftime("%Y-%m-%d %H:%M")} - **用户**: {user_id} - **优先级**: {analysis['priority']} - **类型**: {analysis['type']} - **子 agent 数量**: {len(subagents)} - **状态**: 进行中 - **预计完成**: {analysis['estimated_time']} 分钟 --- """ content += task_record_md memory_file.write_text(content, encoding='utf-8') ``` ### Technical Analysis The `task` and `user_id` parameters are user-controlled values. They are stored without validation in `tasks.json`, and portions of them are interpolated directly into a Markdown file under: ```text /home/admin/.openclaw/workspace/memory/ ``` No Markdown escaping, instruction filtering, trust-boundary annotation, or separation between untrusted task data and trusted agent memory is appli ...[truncated 2118 chars]
- Remediation
- ## Remediation Suggestions 1. Do not write raw user input into prompt-consumed memory. Keep operational task history in a separate data directory that is not automatically loaded into agent context. 2. Store task records as structured data with an explicit schema and field-length limits. 3. If a human-readable memory summary is required, generate a neutral summary rather than copying task text verbatim. 4. Escape Markdown metacharacters and remove headings, role markers, tool-call syntax, and instruction-like control text before persistence. 5. Clearly delimit retained content as untrusted data when it must be provided to an agent. 6. Require explicit user or operator approval before adding externally supplied content to long-term memory. 7. Apply access controls so one user cannot poison memory consumed by another user or tenant. 8. Record provenance, owner identity, creation time, and trust level for every persistent memory entry. 9. Add tests using malicious task strings and user IDs to confirm that persisted values cannot become effective instructions.