T02 · Agent Memory Poisoning
Warning
- Location
- SKILL.md:29
- Finding
- Unrestricted Modification of Persistent Agent Memory and Behavioral Files## Vulnerability Details **File Location**: `SKILL.md:29-36` **Vulnerability Type**: Persistent memory poisoning through untrusted conversation content **Risk Level**: Medium **Vulnerable Code Snippet**: ```markdown 1. **Reads** conversation history from sessions/ 2. **Extracts** user preferences, feedback patterns 3. **Updates** memory files: - MEMORY.md (long-term memory) - AGENTS.md (agent rules) - USER.md (user preferences) - IDENTITY.md (identity notes) - SOUL.md (personality updates) ``` ### Technical Analysis The skill instructions authorize automatic extraction of information from conversation transcripts and modification of several persistent files. The affected files include not only user-preference storage but also `AGENTS.md`, `IDENTITY.md`, and `SOUL.md`, which may control agent rules, identity, and behavior in future sessions. Conversation transcripts are an untrusted input boundary. The instructions do not require schema validation, source attribution, separation between descriptive data and executable instructions, or explicit user approval before persistent changes are made. Consequently, malicious or incorrectly interpreted transcript content could be converted into durable behavioral rules. The supplied `analyzer.py` does not currently implement session reading or file modification; it only returns hard-coded text. Therefore, exploitation depends on a host agent following the behavior declared in `SKILL.md` or on a future implementation adding the documented write functionality without appropriate controls. ### Attack Path 1. An attacker or untrusted participant introduces crafted instructions or false preferences into a conversation transcript. 2. The skill processes that transcript as a source of user preferences or feedback. 3. Crafted content is classified as a persistent rule, identity attribute, or personality update. 4. The host writes the resulting content into `AGENTS ...[truncated 775 chars]
- Remediation
- ## Remediation Suggestions - Restrict automatic updates to a dedicated, structured user-preference data file. - Prohibit automatic modification of `AGENTS.md`, `IDENTITY.md`, `SOUL.md`, and other files that define trusted behavior or identity. - Require explicit user confirmation before persisting each newly inferred preference. - Treat all transcript content as untrusted data and reject imperative instructions from memory fields. - Enforce a strict schema with approved categories, maximum lengths, and normalized value types. - Store source-session identifiers, timestamps, and provenance with every memory item. - Provide review, rollback, expiration, and deletion mechanisms for persisted entries. - Separate the component that extracts candidate preferences from the privileged component that approves and writes them. - Use filesystem allowlists and least-privilege permissions to prevent writes outside the dedicated memory store.