T02 · Agent Memory Poisoning
- Location
SKILL.md:130- Finding
Untrusted User Feedback Can Trigger Persistent Skill Modification
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 130, 205, and 219
Vulnerability Type: Persistent instruction poisoning through user-controlled feedback
Risk Level: MediumComplete Vulnerable Snippets
Line 130:
text 用户指出可复用问题时，立即 patch 对应 Skill，并在该 Skill 的 `EVOLUTION.md` 中记录。English translation:
text When the user identifies a reusable issue, immediately patch the corresponding skill and record it in that skill's `EVOLUTION.md`.Line 205:
text | 反馈不回流 | 同类错误反复出现 | 立即 patch 对应 Skill + EVOLUTION |English translation:
text | Feedback is not incorporated | Similar errors recur | Immediately patch the corresponding skill and EVOLUTION log |Line 219:
text - [ ] 用户反馈已落到对应 Skill 的 `EVOLUTION.md`？English translation:
text - [ ] Has user feedback been written to the corresponding skill's `EVOLUTION.md`?Technical Analysis
The skill treats conversational user feedback as sufficient authority to modify persistent skill instructions. The mandatory direction to “immediately patch” a related skill does not require trusted-owner approval, content validation, security review, path restrictions, or isolation of untrusted text.
An attacker could present adversarial instructions as reusable recruitment-process feedback. If an agent follows this workflow and has file-write access, attacker-influenced rules may be inserted into a related skill or its persistent evolution record. Those changes could then affect later invocations and users.
The vulnerable behavior depends on the executing agent possessing write access to the referenced skill files. The audited package itself contains no executable script that performs the write automatically, so exploitation is instruction-driven rather than direct code execution.
Attack Path
- An attacker invokes the skill in a recruitment-related conversation.
- The attacker characterizes a malicious or misleading rule as reusable process feedback.
...[truncated 1218 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace automatic modification with generation of a proposed patch or structured change request.
- Require explicit approval from a trusted skill owner before writing any change.
- Treat all conversational feedback as untrusted input and prohibit direct insertion into executable or authoritative instructions.
- Permit writes only to an allowlisted staging or proposal directory, not directly to active skill files.
- Validate proposed changes against system safety constraints and reject instructions that alter security boundaries, tool permissions, data-handling requirements, or unrelated behavior.
- Separate factual evolution notes from operative skill instructions so that log content cannot automatically become authoritative.
- Record the requester, reviewer, exact diff, timestamp, and justification for each accepted modification.
- Provide versioning and rollback so poisoned changes can be identified and reverted.
- Update the verification checklist to require authorization and review rather than merely checking whether feedback was persisted.
- Apply the same controls to all referenced specialist skills and their evolution logs.