memory poisoning guard

The problem

AI agents trust their long-term memory implicitly, making it a high-value target for attacks. A single hallucinated fact or a "poisoned" instruction injected via a webpage or tool output can silently steer every future decision the agent makes across different sessions.

What it does

• Screens every candidate memory entry for hallucinations, injections, and attacker-planted "facts" before they are committed to storage.
• Applies a provenance stamp to every entry, recording the source, timestamp, confidence level, and mandatory expiry date.
• Quarantines behavioral rules (e.g., "always skip the check") that originate from untrusted sources like tool outputs or third-party docs.
• Identifies and flags conditional instruction shapes that could serve as dormant backdoor triggers.
• Runs periodic sweeps of existing memory to identify stale entries, contradictions, or legacy debt without proper provenance.

Why this beats prompting it yourself

DIY memory prompts usually focus on retrieval relevance, not security integrity. This skill implements a rigorous decision logic that treats every write as a potential exploit, preventing the "hardening" of hallucinations that occurs when agents summarize their own reasoning as fact. It provides a formal incident response playbook for memory corruption that simple system instructions lack.

Use cases

• Protecting customer support agents from being "reprogrammed" by malicious user queries that land in their persistent notes.
• Ensuring autonomous research agents don't adopt false policies found on crawled websites as permanent operational rules.
• Securing multi-session workflows where an agent's summary of past actions must be verified against actual tool logs to prevent drift.

Known limitations

Requires the agent to have a mechanism for either structured memory (tags/metadata) or a way to prefix informal notes with provenance strings. Does not function as a secret manager.