T02 · Agent Memory Poisoning
- Location
SKILL.md:24- Finding
Unapproved Persistent Modification of Agent Memory and Skill Instructions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:24-25,SKILL.md:47-57; corroborated byreferences/safety-levels.md:6-7
Vulnerability Type: T02: Agent Memory Poisoning
Risk Level: MediumVulnerable Code
SKILL.md:24-25:text | L1 | Knowledge layer | MEMORY.md, logs, notes | Automatic execution | | L2 | Skill layer | SKILL.md (documentation only) | Automatic execution plus recording |SKILL.md:47-57:text Stage 1: Identify a problem ↓ Stage 2: Generate a Gene proposal and write it to PENDING.md ↓ Stage 3: Determine the safety level ↓ ├─ L1/L2 → Execute automatically → Update GENES.md → Track effectiveness ↓ └─ L3/L4 → Request chairman approval ├─ Approved → Execute → Back up → Update GENES.md └─ Rejected → Record the reason → Close the proposalreferences/safety-levels.md:6-7:text | L1 | Knowledge layer | MEMORY.md, logs, notes | Automatic execution | | L2 | Skill layer | SKILL.md and documentation-only Skill templates | Automatic execution plus recording |Technical Analysis
The Skill expressly permits automatic modification of persistent Agent state, including
MEMORY.md, and automatic modification ofSKILL.mdwhen the proposed change is classified as documentation-only. These files can influence behavior in future sessions.Although the policy states that prompt logic must be classified as L3 and approved, the distinction between documentation and operative instructions inside
SKILL.mdis not reliably enforceable. Skill documentation is itself interpreted as Agent instruction, so a nominally documentary L2 change can alter future decision-making without explicit approval.The modification content may originate from observed task failures or other task-controlled context. No requirement is defined to separate trusted observations from untrusted user, document, or tool output before conv ...[truncated 1846 chars]
- Remediation
View remediation
Remediation Suggestions
- Require explicit user approval before every write to
MEMORY.md,SKILL.md, or any other file loaded as persistent Agent context. - Reclassify all
SKILL.mdmodifications as L3 prompt-logic changes, regardless of whether they appear documentary. - Display the target path and an exact proposed diff before approval; never approve only an abstract Gene description.
- Restrict automatic L1/L2 writes to a dedicated, non-executable audit or proposal directory that is not loaded into future Agent context.
- Separate untrusted user, document, web, and tool output from trusted observations. Do not convert untrusted text directly into persistent rules.
- Validate target paths against an explicit allowlist, resolve canonical paths, and reject symlinks or path traversal outside the designated workspace.
- Apply content validation that rejects instructions attempting to weaken safety controls, change approval rules, access prohibited files, or expand tool permissions.
- Preserve immutable audit records containing the source event, proposed content, approver, exact diff, timestamp, and rollback reference.
- Test rollback behavior before deployment and require post-change verification in a restricted environment before persistent instructions become active.
- Retain the existing prohibition on credentials,
.envfiles, private data, andcrontab, and extend it to startup services, shell profiles, hooks, and other persistence mechanisms.
- Require explicit user approval before every write to