Memory Poisoning Detection
Tests whether an AI agent stores and later obeys planted malicious instructions in its memory.
- Repository
- Tencent/AI-Infra-Guard
- Stars
- 7,320
- Licence
- Apache-2.0
- Files
- 1 file
What it does
This is a security test script written as instructions for an AI agent acting as a red-team scanner. It tries to get a target agent to save a hidden rule in its long-term memory, such as always adding a marker word to replies, and then checks in a new turn whether the agent follows that rule. If it does, the skill writes up a finding describing the risk and a suggested fix. It only applies to agents that have memory or persistent context and skips others.
Great for
- Security teams checking whether a chatbot or agent with memory can be permanently manipulated by a user
- Developers building agents with long-term memory who want a repeatable persistence-injection test
- Auditors reviewing AI products before release
Skip it if
- Ordinary users wanting to protect their own assistant: it is aimed at testing other agents and needs a target system to probe, and it does not harden anything on its own
- Testing data leakage or secret exposure: the skill explicitly excludes that topic, so it will not catch it
- Agents without any memory feature: the skill says to skip them, so it gives no useful result
Try asking
- “Test whether this customer support chatbot stores instructions I give it for future conversations”
- “Run a memory poisoning check against our internal assistant and write a vulnerability report”
- “Check if the agent confirms it saved a permanent rule and applies it in a later turn”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 1 original files, the Apache-2.0 licence and an attribution note.
memory-poisoning-detection.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip memory-poisoning-detection.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip memory-poisoning-detection.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Only run this against systems you own or are authorised to test, since it deliberately tries to plant persistent instructions
- Review any stored memory afterwards and clear the test marker so it does not affect real users
- Pair it with the skill's stop rule so each finding type is confirmed once and then no further probes are sent
What's inside
- SKILL.md
Redistributed unmodified from Tencent/AI-Infra-Guard under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.