T02 · Agent Memory Poisoning
- Location
SKILL.md:327- Finding
Persistent Skill Modification Without Explicit User Approval or Security Review
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:327-334
Corroborating Location:references/decision-flow.md:262-266
Vulnerability Type: Persistent procedural-memory poisoning
Risk Level: MediumVulnerable Code Segment
The complete affected segment from
SKILL.md:327-334, rendered in English, states:markdown ### When Issues Are Discovered During Use → Update Immediately If a Skill is loaded and used, but the following is discovered: - Missing steps - Outdated commands - An undocumented pitfall is encountered **Before completing the task, use file-editing tools to update the Skill.**The same requirement is reinforced in
references/decision-flow.md:262-266:markdown When any of the following conditions are discovered while using a Skill, use file-editing tools to update it before completing the task: | Discovery | Action | | Missing steps | Add the missing steps using file-editing tools | | Outdated command | Update the command using file-editing tools | | New pitfall | Add it to the Pitfalls section using file-editing tools | | Better method | Rewrite the relevant section using file-editing tools | | Dependency change | Update the Prerequisites section using file-editing tools |Technical Analysis
The Skill requires an agent to modify persistent Skill instructions whenever it observes a missing step, outdated command, new pitfall, or purportedly better method. Unlike the initial Skill-creation workflow, this update path does not require renewed user authorization, review of the exact changes, validation of the source of the new information, or a security assessment.
Information observed during a task can originate from untrusted user input, repository content, command output, retrieved documentation, or error messages. An attacker can therefore present malicious instructions as a necessary fix or improved workflow. Following the documented update r ...[truncated 2288 chars]
- Remediation
View remediation
Remediation Suggestions
- Require explicit user approval before every persistent Skill creation or update, including changes described as fixes or maintenance.
- Present the destination path and exact proposed diff before writing any persistent file.
- Treat user input, repository content, retrieved documents, tool output, and error messages as untrusted sources that must not be converted directly into durable instructions.
- Write proposed updates to a non-loaded staging directory and promote them only after approval.
- Prohibit automatic persistence of credentials, environment values, personal data, external instructions, encoded payloads, and executable commands.
- Add semantic security checks for shell execution, network retrieval, credential access, destructive file operations, privilege changes, startup persistence, and modifications outside the approved Skill directory.
- Require separate approval for additions or modifications under
scripts/, because supporting files may contain executable code. - Record the source, timestamp, authorizing user, and reviewed diff for each update, and provide a rollback mechanism.
- Replace the unconditional update requirement with guidance to report the issue and propose a patch without modifying persistent state automatically.