T02 · Agent Memory Poisoning
Error
- Location
scripts/memory_engine.py:390- Finding
Persistent Prompt Injection Through Unsanitized Long-Term Memory
- Content
View full analysis
= 0: project = content[max(0, idx - 10):idx + 10].strip() break store.remember(content, tags=[tag, "auto_captured"], importance=imp, source="auto", session_id=session_id, project=project[:50]) ``` Retrieved memory is then inserted verbatim into context intended for an LLM: ```python def build_context_injection(task: str = "", max_tokens: int = 1500) -> str: """Build a context block for injection into LLM prompts""" store = MemoryStore() if task: related = store.search(task, limit=5, min_importance=3) else: related = store.get_recent(limit=8) if not related: return "" lines = [] for m in related: when = datetime.fromtimestamp(m.created_at).strftime("%m-%d") tags = ",".join(m.tags[:3]) lines.append(f"- [★{m.importance}][{tags}]({when}) {m.content[:200]}") result = "## Context from Long-Term Memory\n" + "\n".join(lines) est = len(result) * 1.5 if est > max_tokens: result = result[:int(max_tokens / 1.5)] + "\n...(truncated)" return result ``` ### Technical Analysis The Skill is designed to retain facts, preferences, decisions, and project context across sessions. However, automatic capture accepts text from the current interaction and stores matching se ...[truncated 2614 chars]- Remediation
View remediation