T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:8- Finding
Persistent Storage and Automatic Reloading of Untrusted Task Content
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 3, 8–21, and 41–50
Vulnerability Type: Persistent memory poisoning through unsanitized task-state storage
Risk Level: MediumVulnerable Code
markdown description: Proactive task state management. Use on EVERY task start, progress update, completion, or failure. Tracks what was requested, what's running (background processes, SSH sessions), what's done, and what's next. Survives session resets. Triggers automatically — not user-invoked.markdown ## State File `memory/tasks.md` — single source of truth. ## When to Write 1. **Task received** → add entry with status `🔄 进行中` 2. **Background process started** → record session ID, PID, server, command 3. **Progress update** → update status/notes 4. **Task completed** → mark `✅ 完成`, record results/links 5. **Task failed** → mark `❌ 失败`, record error 6. **Session start** → read `memory/tasks.md` to resume awarenessmarkdown - Update the file BEFORE reporting to user (write-first) - Include enough detail to resume without prior conversation context - For background processes: always record session ID + what server + what command - For multi-step tasks: update after each step - Keep it concise — this isn't a log, it's a state snapshot - **Size limit: keep under 50 lines / 2KB** — this file is read every session start - Completed tasks: collapse to one-line summary, reference daily notes for details - Prune completed tasks older than 3 days - If Active is empty, write （无） to make it obviousTechnical Analysis
The Skill directs the agent to copy task descriptions, progress notes, errors, results, links, commands, hostnames, process identifiers, and session identifiers into
memory/tasks.md. It then treats that file as the “single source of truth” and reloads it at every session start.Task descriptions and related fields can contain attacker-controlled ...[truncated 2604 chars]
- Remediation
View remediation
Remediation Suggestions
- Store task state in a strict structured format with an allowlist of fields, bounded lengths, and validated value types.
- Treat every persisted value originating from users, commands, remote systems, errors, or tool output as untrusted data.
- Add an explicit instruction that text loaded from
memory/tasks.mdmust never override system, developer, user, or Skill instructions and must never be executed as a command. - Clearly delimit or encode stored values so task content cannot be confused with control instructions.
- Persist summaries rather than raw task text, command output, errors, links, or arbitrary notes.
- Require explicit user consent before enabling cross-session persistence, particularly in shared or multi-user environments.
- Redact secrets, access tokens, credentials, sensitive command arguments, internal hostnames, session identifiers, and PIDs before writing state.
- Record opaque references to background jobs instead of full shell commands and infrastructure details unless those values are essential.
- Apply restrictive file permissions and isolate memory files by user, workspace, and agent session.
- Define a short retention period and securely remove expired records rather than relying only on line-count limits.
- Validate restored records against the schema and ignore malformed, unexpectedly formatted, or instruction-like entries.
- Add tests proving that prompt-injection strings stored in task descriptions, notes, errors, and results remain inert when state is restored.