T02 · Agent Memory Poisoning
Warning
- Location
- SKILL.md:14
- Finding
- Untrusted Content Persisted in Agent Memory## Vulnerability Details **File Location**: `SKILL.md`, lines 14–16 and 27–29 **Vulnerability Type**: Persistent prompt injection through untrusted memory content **Risk Level**: Medium ### Vulnerable Code ```markdown 1. Use web search or web fetch to get the page content 2. Extract: destination name, key details, vibe 3. Auto-tag and store in memory ``` ```markdown Remember each save as: "Saved destination: [name] | Tags: [tags] | Source: [url or text] | Date: [today]" ``` ### Technical Analysis The Skill directs the agent to fetch user-supplied web content, derive metadata from it, and persist the resulting destination, tags, and source in long-term memory. The source may also contain raw user-provided text or a URL. No validation, normalization, escaping, length restriction, trust labeling, or instruction/data separation is required before storage. An attacker could therefore place prompt-like instructions in supplied text or in webpage fields likely to be extracted as a destination or related detail. Those values could subsequently be loaded into the agent's context when saved places are recalled. The issue is classified as agent memory poisoning because attacker-controlled content can cross the boundary from untrusted input into persistent state. Whether an injected instruction succeeds depends on how the host agent represents and interprets recalled memory, but the Skill does not prescribe safeguards against that possibility. ### Attack Path 1. An attacker submits a travel-themed URL or plain-text save request containing instruction-like content. 2. The agent fetches the remote page or processes the supplied text. 3. The Skill extracts attacker-controlled content as a destination, tag, detail, or source. 4. The extracted value is stored persistently using the prescribed memory format. 5. During a later request such as “show my saved places,” the poisoned record is loaded from memory. 6. If the host agent fails to preserve the distinction between ...[truncated 845 chars]
- Remediation
- ## Remediation Suggestions 1. Store only a strict structured schema containing validated fields such as destination name, approved tag values, source type, canonical URL, and date. 2. Do not persist raw webpage content, page instructions, arbitrary extracted details, or unrestricted user text. 3. Enforce allowlists for vibe, budget, location, and source tags. Apply length and character limits to free-text destination names. 4. Normalize source URLs and remove embedded credentials, sensitive query parameters, fragments, and unnecessary tracking values before storage. 5. Mark every stored field as untrusted data and ensure recalled values are quoted or rendered as inert content rather than inserted into an instruction context. 6. Reject or safely encode content containing role markers, tool-call syntax, control tokens, or instruction-like phrases. 7. Require confirmation before storing ambiguous or suspicious extracted values. 8. At recall time, use a fixed trusted prompt that explicitly prohibits following instructions found inside memory records. 9. Provide deletion and review controls so users can inspect and remove poisoned records. 10. Add adversarial tests covering prompt injection in page titles, metadata, destination names, URLs, and plain-text save requests.