title: Agent Memory and Configuration File Tampering
id: ATR-2026-00200
status: experimental
description: |
  Detects attempts to write, append, or modify agent memory files (MEMORY.md, SOUL.md, CLAUDE.md) and configuration files (.md, .json, .yaml, .env). Attackers may inject persistent instructions by tampering with files that agents reload across sessions. Derived from real-world Claude Code skill scanning (skill-sanitizer v2.1, 91 hits across 36,394 ClawHub skills).
author: TYSYS (Wind) — skill-sanitizer project
date: 2026/04/05
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: critical
references:
  owasp_llm:
    - LLM01:2025
    - LLM06:2025
  owasp_agentic:
    - ASI04:2026
    - ASI07:2026
  mitre_atlas:
    - AML.T0051.001 - Indirect
  mitre_attack:
    - T1565.001 - Stored Data Manipulation
compliance:
  nist_ai_rmf:
    - subcategory: MG.2.3
      context: Tampering with agent memory and configuration files (MEMORY.md, CLAUDE.md, .env) injects persistent adversarial instructions that survive across sessions; MG.2.3 requires mechanisms to disengage or quarantine the agent when its persistent state is corrupted before reload causes downstream compromise.
      strength: primary
    - subcategory: MP.5.1
      context: Write/append operations targeting agent memory files are an indirect prompt injection vector with high impact magnitude because tampered instructions persist across sessions; MP.5.1 requires identifying and characterizing the likelihood and impact of these persistence-based attack patterns.
      strength: secondary
    - subcategory: GV.6.1
      context: The detection is derived from third-party skill scanning (ClawHub skills), where supplier-provided agent components may modify memory files; GV.6.1 requires policies addressing third-party AI risks including malicious or compromised skills that tamper with agent state.
      strength: secondary
    - subcategory: MS.2.7
      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the skill supply-chain compromise (Agent Memory and Configuration File Tampering).
      strength: primary
    - subcategory: MG.3.1
      context: NIST AI RMF MANAGE 3.1 (third-party resources regularly monitored) is supported where this rule detects the skill supply-chain compromise (Agent Memory and Configuration File Tampering).
      strength: secondary
    - subcategory: MG.3.2
      context: NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the skill supply-chain compromise (Agent Memory and Configuration File Tampering).
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the skill supply-chain compromise (Agent Memory and Configuration File Tampering).
      strength: primary
    - clause: '8.3'
      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the skill supply-chain compromise (Agent Memory and Configuration File Tampering) as a treatment control.
      strength: secondary
  eu_ai_act:
    - article: '15'
      context: Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the skill supply-chain compromise (Agent Memory and Configuration File Tampering).
      strength: primary
    - article: '9'
      context: Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the skill supply-chain compromise (Agent Memory and Configuration File Tampering).
      strength: secondary
tags:
  category: skill-compromise
  subcategory: memory-tampering
  confidence: high
agent_source:
  type: llm_io
  framework:
    - mcp
    - claude-code
  provider:
    - any
detection:
  conditions:
    - field: content
      operator: regex
      value: (?:write|append|modify|edit|overwrite|replace|inject|insert)\s+.{0,50}\b(MEMORY|SOUL|CLAUDE)\.md\b
      description: Direct reference to writing/modifying an agent memory file
    - field: content
      operator: regex
      value: (?:echo|cat|printf|tee)\s+.{0,80}>\s*\S*\b(MEMORY|SOUL|CLAUDE)\.md\b
      description: Shell redirect overwriting an agent memory file
    - field: content
      operator: regex
      value: (?:echo|printf)\s+.{0,80}>>\s*\S*\b(MEMORY|SOUL|CLAUDE)\.md\b
      description: Shell append to an agent memory file
  condition: any
  false_positives:
    - Documentation generators that describe file write operations
    - Legitimate config management skills that update their own config files
response:
  actions:
    - block_tool
    - alert
    - snapshot
  auto_response_threshold: critical
  message_template: '[ATR-2026-00200] CRITICAL: Agent memory/config tampering detected — {matched_pattern}'