T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:148- Finding
Unvalidated User Instructions Can Poison Persistent Agent Memory
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 148–171; related persistence behavior at lines 209, 313–315, and 398
Vulnerability Type:T02: Agent Memory Poisoning
Risk Level: MediumComplete Relevant Snippet
The following is an English rendering of the relevant instructions:
markdown | Layer | Location | Size limit | Loading strategy | | HOT memory | memory.md | 100 lines or fewer | Fully loaded at session start | Automatically capture the following eight types of explicit correction phrases and record them in corrections.md: | Signal type | Example trigger phrase | Recording location | | Direct negation | "No, it should be..." | corrections.md | | Factual correction | "Actually, it is..." | corrections.md | | Error correction | "You are wrong about..." | corrections.md | | Preference expression | "I like X, not Y" | memory.md (HOT) | | Habit emphasis | "Remember that I always..." | memory.md (HOT) | | Repeated reminder | "I told you before..." | corrections.md and promotion evaluation | | Stop instruction | "Do not do X again" | memory.md (HOT) | | Pattern challenge | "Why do you keep..." | corrections.md and reflection | Core principle: Never delete confirmed preferences; only merge, summarize, or demote them. 1. Write to memory.md: "Writing preference: prohibit one expression and use another." 2. Write a style rule to domains/writing.md. 3. Automatically apply this rule to all subsequent writing. All memory is persistently stored in Markdown files under ~/evolve-loop/. At the beginning of a session, the Agent automatically reads memory.md to restore the HOT context.Technical Analysis
The Skill turns conversational statements into persistent behavioral rules and automatically reloads those rules in future sessions. Trigger phrases such as “Remember that I always...” and “Do not do X again” can be written directly to the HOT memory layer.
The ...[truncated 2622 chars]
- Remediation
View remediation
Remediation Suggestions
- Require explicit user confirmation before writing any behavioral rule to persistent memory.
- Never treat quoted text, retrieved documents, web content, tool output, or third-party messages as correction signals.
- Store provenance metadata for every entry, including author, source conversation, timestamp, namespace, confidence, and confirmation status.
- Place new entries in a quarantined or provisional state rather than directly in HOT memory.
- Validate every stored rule against system and developer instructions when writing and loading it.
- Ensure stored memory can never override higher-priority safety, authorization, privacy, or tool-use constraints.
- Default rules to the narrowest applicable namespace and require confirmation before promoting them globally.
- Add configurable expiration periods and require periodic reconfirmation for persistent rules.
- Provide commands to list, inspect, edit, and permanently delete individual memory entries.
- Escape or structurally separate memory data from executable Agent instructions when loading it into context.
- Maintain an audit log of memory creation, modification, promotion, demotion, and deletion events.
- Add tests demonstrating that correction-like phrases in untrusted content cannot create persistent rules.