T01 · Skill Instruction Hijacking
Error
- Location
scripts/install.sh:468- Finding
Persistent Agent Instruction Hijacking and Memory Poisoning
- Content
View full analysis
"$WORKSPACE/AGENTS.md" << AGENTSEOF # AGENTS.md — Operating Protocol $AGENTS_BOOT ## Principles Live in MEMORY.md under 🔴 PRINCIPLES. Follow them always. ``` The installer also writes mandatory persistent rules into `MEMORY.md`: ```text ## 🔴 PRINCIPLES (always loaded, always followed) ### P2: Write It Down Do not mentally note — commit to memory files. Update indexes after significant work. Write before responding: when a user states a preference, makes a decision, gives a deadline, or corrects you, write it to the relevant memory file before composing your response. ``` Lessons inferred from daily logs are promoted into a boot instruction file: ```python def cmd_promote(args: argparse.Namespace) -> int: cfg = load_config(Path(args.config)) data = load_store(Path(args.store)) selected = select_lessons(data, cfg, limit=args.limit, threshold=args.threshold, store=Path(args.store)) path = Path(args.output) if args.output else Path(args.store).parent / "BOOTSTRAP.md" path.parent.mkdir(parents=True, exist_ok=True) lines = ["# Lesson-Imprint", "", "Autogenerated safeguards from repeated past failures. Apply only when relevant and never above system/user instructions.", ""] lines += [f"- [{x['key_type']}:{x['key']}] {x['correct_action']}" for x in selected] path.write_text("\n".join(lines).rstrip() + "\n", encoding="utf-8") print(f"promoted {len(selected)} lessons to {path}") return 0 ``` ### Technical Analysis The installer creates durable agent instruction files and labels their contents as rules that must always be followed. These instructions affect unrelated future sessions rather than remaining s ...[truncated 2042 chars]- Remediation
View remediation