T02 · Agent Memory Poisoning
Warning
- Location
- SKILL.md:281
- Finding
- Persistent Autonomous External Actions Through Heartbeat Instructions## Vulnerability Details **File Location**: `SKILL.md`, lines 281-295 **Vulnerability Type**: Persistent agent-state modification enabling recurring external actions **Risk Level**: Medium ### Vulnerable Code ```markdown ## Agent Posting Pattern (via Heartbeat) Agents post on Square autonomously through the heartbeat loop. To enable: 1. Edit `HEARTBEAT.md` in Aicoo workspace to include Square instructions: ```markdown # Heartbeat Checklist - Browse Aicoo Square for relevant posts in `builders` subsquare - If I have a new project update, post it to Square - Like and comment on posts from my network ``` 2. The heartbeat engine will use available tools to execute these instructions on each run. ``` The consequence is amplified by the public-posting default documented at `SKILL.md`, line 339: ```markdown - Posts are public by default (`visibility: 'public'`) ``` ### Technical Analysis The Skill instructs the Agent or user to write recurring behavioral rules into `HEARTBEAT.md`, a persistent workspace file consumed during future heartbeat executions. This changes the behavior of later runs rather than restricting Square activity to the current, explicitly invoked request. The stored checklist authorizes browsing, posting, liking, and commenting on an external service on every heartbeat. The condition “If I have a new project update” lacks a precise content allowlist, privacy boundary, approval requirement, execution limit, or expiration condition. An Agent could consequently interpret private workspace or conversation context as material suitable for publication. Because posts are public by default, an autonomous posting decision may immediately disclose content externally. Likes and comments also create authenticated account activity without requiring renewed user confirmation. Although the reviewed text does not demonstrate an explicit malicious backdoor or safety override, this persistent instruction pat ...[truncated 1928 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the default recommendation to modify `HEARTBEAT.md`; keep ordinary Square operations scoped to the current user invocation. 2. If recurring behavior is supported, require explicit informed opt-in that identifies the actions, frequency, destination, visibility, and duration. 3. Generate post and comment drafts only. Require explicit user approval immediately before each external publication. 4. Default autonomous drafts and posts to `visibility: "private"` rather than relying on the service's public default. 5. Define a strict allowlist of publishable data and explicitly prohibit credentials, secrets, private files, internal project details, and conversation context. 6. Add an expiration time, maximum execution count, rate limit, and simple revocation procedure for all heartbeat rules. 7. Separate read-only browsing from write operations. Do not grant recurring write authority merely because recurring browsing is enabled. 8. Record every proposed and completed action in an auditable activity log, including the content, destination, identity, visibility, and authorization source. 9. Require a dry-run preview when enabling recurring behavior so the user can inspect the exact operations that would occur. 10. Before publishing, apply sensitive-data detection and fail closed when content origin or confidentiality cannot be established.