T02 · Agent Memory Poisoning
- Location
SKILL.md:84- Finding
Automatic Promotion of Conversation-Derived Content into Persistent Agent Instructions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 84-92
Vulnerability Type: Persistent agent memory poisoning
Risk Level: HighCode Snippet:
markdown ## 自动晋级规则 当满足以下条件时**自动晋级**： | 目标文件 | 条件 | |---------|------| | `SOUL.md` | 行为模式类学习，复发≥2次 | | `TOOLS.md` | 工具相关，复发≥2次 | | `AGENTS.md` | 工作流相关，已解决 | | `CLAUDE.md` | 项目约定，复发≥3次 | | 技能提取 | 跨3+个不同任务复发 |The permissive promotion policy is reinforced at
SKILL.md:427:markdown 7. **积极晋级** - 存疑时优先晋级Technical Analysis
The skill instructs the agent to promote information derived from conversations and learning records into authoritative, persistent instruction files such as
SOUL.md,TOOLS.md,AGENTS.md, andCLAUDE.md. These files can influence agent behavior, tool use, workflows, and project conventions in future sessions.Recurrence count is treated as sufficient evidence that content is safe to promote. Repetition does not establish trust: an attacker can deliberately repeat a crafted correction or recommendation until the configured threshold is reached. The instruction to favor promotion when uncertain further weakens the trust boundary.
No source validation, provenance enforcement, content sanitization, human approval, or distinction between descriptive observations and executable agent instructions is specified. Consequently, attacker-controlled conversation content can be transformed into durable behavioral policy.
Attack Path
- An attacker supplies a crafted correction or “best practice” containing a behavioral directive.
- The attacker repeats or rephrases that directive until its recurrence count reaches the applicable threshold.
- The skill records the content as a learning or behavioral pattern.
- The automatic promotion workflow classifies it as behavior-, tool-, workflow-, or project-related.
- The content is written into an authoritative file such as
SOUL.mdorAGENTS.md.
...[truncated 731 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove automatic writes to
SOUL.md,TOOLS.md,AGENTS.md,CLAUDE.md, and other authoritative instruction files. - Store learned observations only in a non-authoritative data file that is never interpreted as agent policy.
- Require explicit, informed human approval for every proposed promotion.
- Display the exact source, destination, and proposed diff before approval.
- Track immutable provenance, including session, author, timestamp, and original text.
- Reject learning content containing tool commands, role changes, safety overrides, secret-handling instructions, or directives to modify memory.
- Replace recurrence-based trust with an allowlisted promotion schema and independent validation.
- Remove the “promote when uncertain” policy and default to no promotion.
- Make promoted changes reversible through backups, version control, and an audit log.
- Remove automatic writes to