T02 · Agent Memory Poisoning
- Location
SKILL.md:28- Finding
Persistent Agent Memory and Behavior Poisoning Through Unvalidated Interaction Content
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 28-50; additional triggering instructions at lines 77-89
Vulnerability Type: T02: Agent Memory Poisoning
Risk Level: CriticalVulnerable Instructions
SKILL.md, lines 28-50:markdown ## Self-Improvement Workflow ### Step 1: Capture Learning After any triggering event, immediately: - Update `MEMORY.md` with new insights/lessons - Update `memory/YYYY-MM-DD.md` with the event - If mistake: add to "本猫犯过的错误/教训" section in MEMORY.md - If preference: update "腿腿哥的新偏好/要求" section ### Step 2: Reflect Ask: "What can I learn from this?" - What went wrong? - What should I do differently? - What files need updating? ### Step 3: Act Immediately update relevant files: - MEMORY.md for long-term improvements - Daily memory files for event-specific lessons - AGENTS.md or SOUL.md if persona/tone changes neededSKILL.md, lines 77-89:markdown When user says "learn from this": 1. Read relevant memory files 2. Identify the lesson 3. Update MEMORY.md immediately 4. Confirm update to user When agent makes a mistake: 1. Acknowledge the mistake 2. Explain what went wrong 3. Update relevant files 4. Tell user what will changeTechnical Analysis
The skill instructs the agent to transform conversational input, including user feedback and requests to remember information, into persistent entries in
MEMORY.mdand dated memory files. It also permits modification ofAGENTS.mdandSOUL.md, which may govern future agent behavior or persona.No validation, provenance tracking, safety-policy conflict check, content-type restriction, expiration mechanism, or explicit per-change confirmation is required before these writes occur. The trigger is also unusually broad: it includes ordinary feedback, perceived mistakes, pattern detection, and completion of any task. Consequently, attacker-controlled instructions ...[truncated 2084 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove automatic writes triggered by task completion, perceived mistakes, or untrusted conversational feedback.
- Require explicit, informed user confirmation for each proposed persistent change, showing the exact destination file and normalized content before writing.
- Prohibit this skill from modifying instruction-bearing files such as
AGENTS.md,SOUL.md, system prompts, tool definitions, and policy files. - Store learning records in a dedicated structured data file rather than executable or instruction-bearing Markdown. Separate descriptive observations from behavioral directives.
- Reject entries containing commands, role changes, policy overrides, tool-use instructions, encoded payloads, or requests to ignore higher-priority instructions.
- Attach provenance metadata to every accepted entry, including source, timestamp, author, scope, approval status, and expiration date.
- Apply least-privilege filesystem controls so the skill can write only to its dedicated learning store.
- Add conflict checks against system, developer, security, and privacy requirements before accepting a proposed lesson.
- Implement review, rollback, deletion, deduplication, and expiration mechanisms for all persistent entries.
- Treat stored memory as untrusted data when loading it in future sessions; do not interpret memory content as higher-priority instructions.