T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:10- Finding
Automatic Cross-Session Persistence of Potentially Sensitive and Attacker-Controlled Task Data
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 10-41
Vulnerability Type: Persistent agent-memory poisoning and sensitive operational-data retention
Risk Level: MediumVulnerable Code
markdown ## State File `memory/tasks.md` — single source of truth. ## When to Write 1. **Task received** → add entry with status `🔄 进行中` 2. **Background process started** → record session ID, PID, server, command 3. **Progress update** → update status/notes 4. **Task completed** → mark `✅ 完成`, record results/links 5. **Task failed** → mark `❌ 失败`, record error 6. **Session start** → read `memory/tasks.md` to resume awareness ## Format ```markdown # Active Tasks ## [task-id] Short description - **Status**: 🔄 进行中 | ✅ 完成 | ❌ 失败 | ⏸️ 暂停 - **Requested**: YYYY-MM-DD HH:MM - **Updated**: YYYY-MM-DD HH:MM - **Background**: session-id (PID) on server-name — `command` - **Notes**: progress details, partial results - **Result**: final output, links, summary # Completed (recent) <!-- Move completed tasks here, keep last 10, prune older -->Rules
- Update the file BEFORE reporting to user (write-first)
- Include enough detail to resume without prior conversation context
- For background processes: always record session ID + what server + what command
text ### Technical Analysis The Skill designates `memory/tasks.md` as a cross-session source of truth and requires it to be read at session startup. It also mandates writing task descriptions, commands, server names, process identifiers, links, results, errors, and free-form progress notes before responding to the user. These fields can contain attacker-controlled instructions or sensitive operational data. The Skill provides no requirement to sanitize instruction-like content, redact credentials, restrict file permissions, distinguish trusted metadata from untrusted text, or obtain user consent before persistence. Conseque ...[truncated 1872 chars]- Remediation
View remediation
Remediation Suggestions
- Make persistent tracking explicitly opt-in and task-scoped instead of activating it for every task and session.
- Treat all persisted values as untrusted data. Use a strict structured schema and prevent task descriptions, notes, links, errors, and results from being interpreted as agent instructions.
- Do not store raw commands, credentials, access tokens, private URLs, internal hostnames, or complete error output. Record only redacted summaries.
- Apply automatic secret detection and redaction before every write, including filtering command-line arguments and URL query parameters.
- Require confirmation before recording infrastructure details or other potentially sensitive information.
- Store the file with least-privilege filesystem permissions and isolate memory by user, workspace, and task.
- On session startup, parse only expected structured fields rather than inserting the complete file into the agent's instruction context.
- Enforce short retention limits and provide users with mechanisms to inspect, correct, and delete stored state.
- Replace the unconditional “write-first” requirement with a policy that prioritizes authorization, validation, and redaction before persistence.