T02 · Agent Memory Poisoning
Error
- Location
- SKILL.md:73
- Finding
- Persistent Agent Memory Poisoning Through Untrusted Behavioral Feedback## Vulnerability Details **File Location**: `SKILL.md:37-39, 73-79` **Vulnerability Type**: `T02: Agent Memory Poisoning` **Risk Level**: High ### Vulnerable Code ```markdown **At conversation start**: Check whether `MEMORY.md` exists. If it does, read the index and surface relevant memories to the user. **Before context limit**: Proactively write important content from the current session into memory files and update `MEMORY.md`, so the next session can resume seamlessly. ``` ```markdown ### feedback — Behavior Correction Records behaviors the user has corrected. **Highest priority** — always follow these rules in future sessions. **When to write**: When the user says "don't do that", "stop doing…", or any explicit correction. Lead with the rule, then `**Why:**` (reason given) and `**How to apply:**` (scope). ``` ### Technical Analysis The Skill directs the agent to convert user-provided corrections into persistent behavioral rules and to treat those rules as having the “highest priority” in future sessions. It then automatically loads the memory index when subsequent conversations begin. Conversation content is untrusted input. Persisting an arbitrary correction as a future behavioral directive creates a stored instruction-injection channel. The Skill does not require user confirmation before persistence, validate whether a correction attempts to weaken safety constraints, constrain stored instructions beneath system and developer messages, or define expiration and provenance controls. The declared credential-storage restrictions reduce the risk of directly persisting secrets but do not address malicious behavioral instructions. An attacker can phrase an unsafe or task-altering directive as an explicit correction, causing it to be stored and repeatedly applied outside the context in which it was supplied. ### Attack Path 1. An attacker interacts with an agent that has loaded this Skill. 2. The attacker presents a hostile directive as behavioral fe ...[truncated 1409 chars]
- Remediation
- ## Remediation Suggestions 1. Treat every stored memory as untrusted reference data, not as an executable instruction or authority-bearing policy. 2. Remove the phrases “highest priority” and “always follow.” Explicitly state that stored memories cannot override system, developer, safety, or current-session instructions. 3. Require informed user confirmation before creating or updating persistent memory. 4. Validate feedback before persistence and reject content that: - Attempts to change instruction priority. - Weakens safety or authorization requirements. - Requests hidden behavior or suppression of disclosures. - Grants permissions or authorizes actions outside the current task. 5. Store provenance metadata, including the source conversation, creator, creation time, scope, and expiration time. 6. Scope feedback to a specific user, project, or task rather than applying it globally. 7. Present retrieved memories as quoted contextual information and require the agent to reassess their relevance and safety before use. 8. Provide mechanisms to list, inspect, edit, expire, and delete stored memories. 9. Avoid automatic persistence before context exhaustion. Instead, generate a proposed memory summary and request approval. 10. Add conflict handling that ignores stored memories whenever they contradict higher-priority instructions or current authorization boundaries.