T02 · Agent Memory Poisoning
Warning
- Location
- SKILL.md:10
- Finding
- Automatic Cross-Session Persistence of Potentially Sensitive and Attacker-Controlled Task Data## Vulnerability Details **File Location**: `SKILL.md`, lines 10-41 **Vulnerability Type**: Persistent agent-memory poisoning and sensitive operational-data retention **Risk Level**: Medium ### Vulnerable Code ```markdown ## State File `memory/tasks.md` — single source of truth. ## When to Write 1. **Task received** → add entry with status `🔄 进行中` 2. **Background process started** → record session ID, PID, server, command 3. **Progress update** → update status/notes 4. **Task completed** → mark `✅ 完成`, record results/links 5. **Task failed** → mark `❌ 失败`, record error 6. **Session start** → read `memory/tasks.md` to resume awareness ## Format ```markdown # Active Tasks ## [task-id] Short description - **Status**: 🔄 进行中 | ✅ 完成 | ❌ 失败 | ⏸️ 暂停 - **Requested**: YYYY-MM-DD HH:MM - **Updated**: YYYY-MM-DD HH:MM - **Background**: session-id (PID) on server-name — `command` - **Notes**: progress details, partial results - **Result**: final output, links, summary # Completed (recent) <!-- Move completed tasks here, keep last 10, prune older --> ``` ## Rules - Update the file BEFORE reporting to user (write-first) - Include enough detail to resume without prior conversation context - For background processes: always record session ID + what server + what command ``` ### Technical Analysis The Skill designates `memory/tasks.md` as a cross-session source of truth and requires it to be read at session startup. It also mandates writing task descriptions, commands, server names, process identifiers, links, results, errors, and free-form progress notes before responding to the user. These fields can contain attacker-controlled instructions or sensitive operational data. The Skill provides no requirement to sanitize instruction-like content, redact credentials, restrict file permissions, distinguish trusted metadata from untrusted text, or obtain user consent before persistence. Conseque ...[truncated 1872 chars]
- Remediation
- ## Remediation Suggestions 1. Make persistent tracking explicitly opt-in and task-scoped instead of activating it for every task and session. 2. Treat all persisted values as untrusted data. Use a strict structured schema and prevent task descriptions, notes, links, errors, and results from being interpreted as agent instructions. 3. Do not store raw commands, credentials, access tokens, private URLs, internal hostnames, or complete error output. Record only redacted summaries. 4. Apply automatic secret detection and redaction before every write, including filtering command-line arguments and URL query parameters. 5. Require confirmation before recording infrastructure details or other potentially sensitive information. 6. Store the file with least-privilege filesystem permissions and isolate memory by user, workspace, and task. 7. On session startup, parse only expected structured fields rather than inserting the complete file into the agent's instruction context. 8. Enforce short retention limits and provide users with mechanisms to inspect, correct, and delete stored state. 9. Replace the unconditional “write-first” requirement with a policy that prioritizes authorization, validation, and redaction before persistence.