T02 · Agent Memory Poisoning
- Location
SKILL.md:33- Finding
Persistent Agent Memory and Instruction-File Poisoning
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 33 and 93–148
Vulnerability Type: Persistent injection of knowledge-graph content into Agent context and control files
Risk Level: MediumVulnerable Code Snippet
The following is an English translation of the relevant statements in
SKILL.md:text On each session start, generate a compact KGML summary and inject it into the context, allowing the Agent to retain structured long-term memory.text On each session start, the Agent automatically reads `kg-summary.md` and brings key entities and relationships into the context.bash node scripts/install.mjs --workspace /path/to/workspace --platform skill-platformtext The installation script automatically detects the platform type (skill-platform / claude / gemini), modifies `AGENTS.md`, `CLAUDE.md`, or `GEMINI.md` as appropriate, and injects knowledge-graph instructions and summaries.Technical Analysis
The Skill describes an installation process that modifies persistent Agent control files and causes knowledge-graph summaries to be loaded automatically in subsequent sessions. The affected control files include
AGENTS.md,CLAUDE.md, andGEMINI.md.Knowledge-graph information may originate from user documents, conversations, or other externally supplied text. The documented workflow does not establish a trust boundary between stored knowledge and executable Agent instructions. It also does not specify schema enforcement, neutralization of instruction-like content, provenance validation, or separation of untrusted data from the Agent's instruction context.
An attacker could therefore supply content containing directive-like text that is incorporated into
kg-summary.md. If that summary is subsequently injected into an Agent control file or automatically loaded as trusted context, the malicious content may persistently influence future Agent behavi ...[truncated 2046 chars]- Remediation
View remediation
Remediation Suggestions
- Do not automatically modify
AGENTS.md,CLAUDE.md,GEMINI.md, or other persistent Agent instruction files. - Require explicit user approval before modifying any control file, and display the exact proposed patch before applying it.
- Treat
kg-summary.mdand all knowledge-graph values as untrusted data rather than Agent instructions. - Place retrieved graph content inside a clearly delimited data block with an explicit instruction that its contents must not be followed as commands.
- Enforce a strict schema for generated summaries and reject unexpected fields, role markers, tool-call syntax, control directives, and instruction-like content.
- Preserve source provenance for every entity and relationship so that content from untrusted sources can be excluded from automatic context loading.
- Encode or escape control tokens and other syntax that the target Agent platform may interpret as instructions.
- Separate persistent knowledge storage from persistent behavioral rules. Knowledge updates must never alter system or workspace policy.
- Apply size limits, allowlists, and review requirements before any generated summary is loaded into a new session.
- Provide an uninstall and rollback operation that removes injected instructions and restores the original control files.
- Include the referenced scripts in future audit packages so their path validation, file-write boundaries, sanitization, and rollback behavior can be independently reviewed.
- Do not automatically modify