T02 · Agent Memory Poisoning
Error
- Location
skill.py:39- Finding
Untrusted Chat Content Is Written into Persistent Agent Memory
- Content
View full analysis
2] if not valid_lines: return None chunked_text = " | ".join(valid_lines) if len(chunked_text) > 500: chunked_text = chunked_text[:250] + " ... [DATA TRUNCATED] ... " + chunked_text[-200:] return chunked_text def inject_to_hippocampus(chunked_text): if not os.path.exists(os.path.dirname(OS_HIPPOCAMPUS_PATH)): print("⚠️ [Hook] OS 意识目录不存在，请先运行 S2-Silicon-Soul-OS！") return False logs = [] if os.path.exists(OS_HIPPOCAMPUS_PATH): try: with open(OS_HIPPOCAMPUS_PATH, 'r', encoding='utf-8') as f: logs = json.load(f) except Exception: pass timestamp = datetime.now().isoformat() logs.append({ "timestamp": timestamp, "type": "SENSORY_INPUT", "raw_text": f"[AUTO-HOOKED CHAT] {chunked_text}" }) with open(OS_HIPPOCAMPUS_PATH, 'w', encoding='utf-8') as f: json.dump(logs, f, ensure_ascii=False, indent=2) return True ``` Invocation path: ```python chunked_session = chunk_and_summarize(new_lines) if chunked_session: success = inject_to_hippocampus(chunked_session) ``` ### Technical Analysis The skill reads chat-log content and writes it directly into `s2_consciousness_data/hippocampus_logs.json` as `SENSORY_INPUT`. The only processing applied is whitespace filtering, line concatenation, and length truncation. None of these operations establish trust or neutralize instructions embedded in the source text. The persisted record does not contain a trust classification, verified origin, or explicit indication that downstream consumers must treat `raw_text` exclusively ...[truncated 1842 chars]- Remediation
View remediation