T02 · Agent Memory Poisoning
Warning
- Location
- SKILL.md:34
- Finding
- Persistent Agent-State Influence Through Mandatory Memory Promotion<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 34–97 **Vulnerability Type**: Persistent contamination of agent memory and behavioral state **Risk Level**: Medium ### Vulnerable Code ```markdown ## Canonical Files - `memory/short_term/YYYY-MM-DD.md` (raw evidence) - `memory/mid_term/MEMORY.md` (near-term reusable conclusions) - `memory/long_term/MEMORY.md` (stable collaboration constraints) - `memory/knowledge.md` (transferable methods/policies) - `self-model.md` (current strengths/failures/growth themes/uncertainties) - `memory/check_memory.json` (daily/weekly gate state) ## Required Promotion Rules ### Update `self-model.md` only when: 1. recurring failure mode is re-validated 2. strength gains new evidence 3. active growth theme should switch ### Update `memory/knowledge.md` only when: 1. method is reusable across multiple scenarios 2. explicit evidence supports it 3. rule can be expressed as `if X then Y` ### Update `memory/long_term/MEMORY.md` only when: 1. improves long-term collaboration quality 2. is not short-term fluctuation ## Entry Quality Contract (mid/long) Every promoted item must include: - `reason` - `evidence` - `confidence` (`low|medium|high`) ## Task Coupling (Mandatory) For medium/high complexity tasks: 1. read `self-model.md` + `memory/knowledge.md` 2. write preflight checklist: - goal - success criteria - risks - uncertainty 3. include one post-task reflection item before execution starts ## Gate Model (`memory/check_memory.json`) Use dual gate state: ```json { "daily_need_update": 1, "daily_update_done": 0, "weekly_need_update": 1, "weekly_update_done": 0 } ``` Semantics: - `1/0` = pending - `0/1` = done - anything else = invalid; normalize to `1/0` ## Scheduling Pattern - Daily cycle: promote short->mid + prune short-term retention - Weekly cycle: promote mid->long - Heartbeat: recovery path only (when gate remains pending) Strict rule: success is valid only if gate flips to d ...[truncated 2932 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require explicit user approval before promoting any entry into `memory/knowledge.md`, `memory/long_term/MEMORY.md`, or `self-model.md`. 2. Store provenance with every entry, including the originating task, source type, source location, author or trust domain, creation time, and approval status. 3. Treat documents, retrieved content, repository text, and tool output as untrusted data. Never promote embedded instructions from those sources into behavioral policy. 4. Separate memory by user, project, and trust domain so content from one context cannot silently influence another. 5. Define an instruction hierarchy stating that persisted memory is advisory and can never override platform safety controls or current authorized user instructions. 6. Add review, expiry, revocation, and rollback mechanisms for every promoted entry. 7. Require corroboration from multiple independent trusted sources before promoting security-sensitive or behavior-changing conclusions. 8. Change the gate logic so successful completion of the user's primary task does not depend on a persistent memory write. Permit a safe “no update needed” state. 9. Validate memory files against a strict schema and prevent free-form content from being interpreted as executable commands or higher-priority instructions. 10. Maintain an append-only audit trail of promotions, approvals, edits, reads, and deletions so contamination can be investigated and reversed. ]]>