T02 · Agent Memory Poisoning
- Location
SKILL.md:164- Finding
Untrusted User Feedback Can Persistently Modify Skill Instructions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, line 164
Vulnerability Type: Persistent instruction poisoning through automatic self-modification
Risk Level: MediumVulnerable Code Snippet
markdown 用户指出可复用问题时，立即更新本 Skill 并在 [EVOLUTION.md](EVOLUTION.md) 记录。English translation:
text When the user identifies a reusable issue, immediately update this Skill and record it in EVOLUTION.md.Technical Analysis
The Skill instructs the agent to modify its persistent instruction files whenever a user characterizes feedback as reusable. The workflow does not require the feedback to be authenticated, reviewed by a maintainer, validated against security policies, or presented as a proposed diff before it is written.
Because
SKILL.mdcontrols future agent behavior andEVOLUTION.mdrecords persistent changes, ordinary task input can cross the boundary from session-specific context into durable agent state. An attacker could frame a malicious behavioral rule as a reusable correction and induce the agent to incorporate it into the Skill. If the execution environment grants write access to these files, the injected rule could affect later sessions and users.This issue is conditional on the hosting agent having permission and tooling to modify the Skill package. The audited repository itself contains no script that performs the write automatically.
Attack Path
- An attacker invokes the Skill with an otherwise legitimate job-description request.
- The attacker provides a purported reusable correction containing an attacker-controlled rule.
- The attacker asks the agent to treat that rule as generally applicable rather than specific to the current task.
- Following
SKILL.md:164, a write-capable agent updatesSKILL.mdand records the change inEVOLUTION.md. - The modified instruction is loaded in later sessions.
- Subsequent outputs may follow the attacker-controlled rule without the later user knowing that persiste ...[truncated 688 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the requirement to update Skill files automatically from ordinary user feedback.
- Treat feedback as session-local by default and do not write it into persistent instructions.
- Store proposed reusable feedback in an isolated draft or structured review queue rather than in
SKILL.md. - Require explicit authorization from a trusted maintainer before applying persistent changes.
- Display the exact proposed diff and affected files before requesting approval.
- Validate proposed changes against fixed safety constraints and reject instructions that expand permissions, weaken safeguards, introduce external execution, or alter unrelated behavior.
- Restrict the runtime agent to read-only access to installed Skill packages whenever self-modification is not required.
- Maintain an auditable change history with author identity, approval status, timestamps, and rollback support.
- Replace the vulnerable instruction with wording such as:
markdown When a user identifies a potentially reusable issue, summarize it as a session-local improvement proposal. Do not modify Skill files. Persistent changes require explicit review and approval by an authorized maintainer.