T02 · Agent Memory Poisoning
- Location
SKILL.md:48- Finding
Untrusted User Content Can Poison Persistent Agent Memory
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 48–51; related persistence instructions at lines 82–83 and 89–91
Vulnerability Type:T02: Agent Memory Poisoning
Risk Level: MediumVulnerable Instruction Snippet
The following is an English translation of the relevant instructions in
SKILL.md, lines 48–51:text Hot memory (SESSION-STATE.md): Active working memory that survives compression and restarts. It records the current task, key context, pending actions, and recent decisions. The Agent reads this file before every response. WAL protocol guarantee: User input triggers a write, and state must be written before replying. Trigger conditions include a user expressing a preference, making a decision, providing a deadline, or correcting the Agent. Session memory protocol: At session start, read SESSION-STATE.md and check the daily memory file. During the conversation, when the user supplies specific details, write them before replying. At session end, migrate important content into MEMORY.md.Related instructions at lines 82–83 and 89–91 require adding persistent rules to
AGENTS.mdorSOUL.md, loadingSESSION-STATE.mdwhen a session starts, and recording errors inmemory/lessons.md.Technical Analysis
The Skill requires an Agent to persist user-controlled preferences, decisions, deadlines, corrections, and other details before responding. Stored records are subsequently loaded as context and may be promoted from the session-state file into long-term memory.
No trust boundary separates factual data from instructions. The documented workflow does not require provenance metadata, structured quoting, prompt-injection screening, user confirmation, or review before long-term promotion. Consequently, attacker-controlled imperative text can be stored alongside legitimate context and later interpreted as an authoritative instruction.
Installing mandatory loading and re ...[truncated 1645 chars]
- Remediation
View remediation
Remediation Suggestions
- Store user-supplied content as explicitly quoted data rather than as Agent instructions.
- Attach structured metadata to every record, including source, timestamp, author, trust level, content type, and originating session.
- Separate factual memories, user preferences, and executable workflow directives into distinct schemas and files.
- Treat every loaded memory record as untrusted input and explicitly prohibit following commands embedded in memory.
- Detect and quarantine imperative language, role-change requests, safety-policy overrides, encoded payloads, and instructions requesting tool use.
- Require explicit user confirmation before promoting session content into
MEMORY.mdor persistent topic files. - Load only records relevant to the current task instead of indiscriminately loading all persisted content.
- Add review, deletion, expiration, versioning, rollback, and audit-log mechanisms for persistent records.
- Do not place attacker-controlled text directly into
AGENTS.md,SOUL.md, or other Agent configuration files. - Remove the unnecessary
exectool declaration because the Skill states that command execution is not required, thereby reducing the impact of any future memory-poisoning attempt.