T02 · Agent Memory Poisoning
- Location
SKILL.md:897- Finding
Mandatory Persistent Modification of Shared Skill Knowledge
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:118,SKILL.md:897-918, andSKILL.md:954. The same instructions are mirrored inSKILL.html:1423,SKILL.html:2679-2720, andSKILL.html:2779.Vulnerability Type: Persistent poisoning of shared agent knowledge from potentially untrusted review input
Risk Level: Medium
Vulnerable Code Snippet
The following English rendering preserves the meaning of the relevant instructions:
text Rule 7: New defect patterns must be updated in the knowledge base and cannot be omitted.markdown ## Phase 12: Knowledge Retention and Continuous Improvement ### Update the checklist - Add newly discovered defect scenarios to `checklists/review-checklist.md`. - Regularly review and update the completeness of the checklist. - Update quality baselines based on measurement data. ### Update example scenarios - Add typical cases to `examples.md`. - Record specific testing steps and verification methods. - Add production incident cases and root-cause analyses. ### Update knowledge-base files | File | Update condition | Content | |------|------------------|---------| | `checklists/review-checklist.md` | A new inspection item is found | Add the new inspection point | | `examples.md` | A new typical scenario is found | Add the new example | | `templates/test-case-template.md` | A new testing method is found | Add the new testing strategy | | `docs/quality-gate-workflow.md` | Quality measurement data changes | Update quality baselines and inspection standards |text Skipping knowledge retention | Update the knowledge base after every review.Technical Analysis
The Skill requires review findings to be written into persistent, shared behavioral reference files. These files influence future quality reviews, test strategies, examples, and quality-gate decisions.
The review input may include untrusted requirements, source code, reports, examples, or adversarial instructions. A malicious projec ...[truncated 2245 chars]
- Remediation
View remediation
Remediation Suggestions
- Make all shared knowledge-base modifications opt-in rather than mandatory.
- Require explicit user approval before writing to any Skill-owned file.
- Present a complete proposed diff, affected paths, rationale, and source provenance before requesting approval.
- Store findings from untrusted inputs in a project-local draft, such as
docs/review/proposed-knowledge-updates.md, instead of directly changing shared instructions. - Establish a promotion process requiring human review before project-local proposals become global Skill guidance.
- Validate proposed entries for provenance, duplication, factual correctness, scope, and conflicts with existing security rules.
- Treat all reviewed artifacts as untrusted data and prohibit their instructions from directly becoming agent behavior.
- Restrict write access to an explicitly approved workspace directory and deny modification of loaded Skill instructions by default.
- Record an audit trail containing the source project, approving user, timestamp, proposed change, and validation result.
- Remove the unused
executepermission fromallowed-toolsto improve least privilege, because the documented workflows do not require command execution.