T02 · Agent Memory Poisoning
Warning
- Location
- scripts/add.sh:24
- Finding
- Persistent Agent Memory Poisoning Through Unvalidated Multiline Entries## Vulnerability Details **File Location**: `scripts/add.sh`, lines 24-25 and 64-86 **Vulnerability Type**: Persistent memory-content injection **Risk Level**: Medium ### Vulnerable Code ```bash CATEGORY=$(echo "$1" | tr '[:lower:]' '[:upper:]') ENTRY="$2" # Add entry to the file using sed TEMP_FILE=$(mktemp) # Find the section and add entry after the header awk -v cat="$CATEGORY" -v entry="$ENTRY" ' BEGIN { in_section = 0 } /^## \['"$CATEGORY"'\]/ { print in_section = 1 next } in_section && /^## / { in_section = 0 } in_section && /^- $/ { print "- ["cat"] "entry in_section = 0 next } { print } ' "$TODAY_FILE" > "$TEMP_FILE" mv "$TEMP_FILE" "$TODAY_FILE" ``` ### Technical Analysis The entry supplied through the second command-line argument is assigned directly to `ENTRY` and passed to `awk` without structural validation. Although shell quoting prevents direct shell-command injection, it does not prevent newline characters, Markdown headings, fabricated categories, or instruction-like content from being stored. When `entry` contains newline characters, the `print` operation emits those newlines into the daily memory file. An attacker-controlled entry can consequently escape the intended Markdown list item and create arbitrary additional sections or text. For example, an entry could add a fabricated heading followed by instructions that appear to be trusted persistent memory. This is especially relevant because the Skill is explicitly designed to make future Agent sessions search, review, and potentially promote daily entries into the long-term `MEMORY.md` file. The injected content therefore crosses a persistence boundary and may influence subsequent Agent decisions. ### Attack Path 1. An attacker causes untrusted content to be supplied as the entry argument to `add.sh`, directl ...[truncated 1291 chars]
- Remediation
- ## Remediation Suggestions 1. Reject entries containing carriage returns or newline characters unless multiline storage is explicitly required. 2. Normalize every entry to a single logical line before writing it: ```bash ENTRY=${2//$'\r'/ } ENTRY=${ENTRY//$'\n'/ } ``` 3. Enforce a reasonable maximum entry length to reduce abuse and accidental memory corruption. 4. Escape or encode Markdown control characters if entries must remain data rather than document structure. 5. Store memory in a structured format such as JSON with explicit fields for category, date, and content, then generate Markdown only for display. 6. Treat recalled memory as untrusted data rather than executable Agent instructions. 7. Require explicit review and confirmation before promoting daily content into long-term `MEMORY.md`. 8. Validate that generated files contain only the expected headings and entry structure before replacing the original file.