owasp-asi06-memory-context-poisoning

Links

• github.com/open-coder-ai/chock-catalog
• agentic-security/owasp-asi06-memory-context-poisoning/plugin.json (manifest)

Skills · 1

• owasp-asi06-memory-context-poisoning

Category

Security & Compliance — assigned by this directory, not declared in the manifest.

Keywords

chock · policy-as-code · rule · advise · asi06

Related plugins

• protect-agent-configopen-coder-ai

  Guard against an agent hand-editing its own guardrails. Agent instruction files (AGENTS.md and the per-agent wrappers), permission files (.claude/settings.json, .mcp.json) and vendored enforcement (.chock/bin/, .chock/compiled/) define what the agent may do -- so a shell command that rewrites them is the agent modifying its own authority (MITRE ATLAS AML.T0081; the AIVSS self-modification factor). The guard refuses shell write-commands targeting those paths; reads pass, and regeneration through `chock sync` passes because the tool writes them itself rather than through shell editing. Best-effort and deliberately coarse: a compound command that both reads a protected file and writes elsewhere may be refused -- rewrite it in two steps. Escape for a human-approved change: include 'chock: approved-config-change' in the command.

• protect-commit-privacyopen-coder-ai

  Keep the development conversation out of git history. Agent-authored commits narrate by default -- who asked for what, which discussion decided it, what the plan was -- and on a public repo that narration is published forever. The guard refuses git commit commands whose message (inline -m/--message or the file behind -F/--file) contains process-leak markers; the rule tells the agent to describe the change, not the conversation, and to propose sensitive messages to the human before committing. Best-effort: markers are a narrow deny-list, and a message the human explicitly approves can say anything -- edit the marker list in the guard, the content is yours.

• agent-disciplineopen-coder-ai

  trigger: edits without reading, unverified completion claims, weakened tests, dead code. avoid: skipping verification, deleting assertions, leaving unused code.

• block-destructive-commandsopen-coder-ai

  Best-effort guard against destructive commands: rm -rf targeting absolute, home, or root-adjacent paths; git push --force (not --force-with-lease); git reset --hard; git clean -f; kubectl delete; terraform destroy. Known bypass classes include aliases, quoted arguments, non-standard clients, and scripts that invoke these commands indirectly. This is friction, not a security boundary.

• block-no-verifyopen-coder-ai

  Best-effort guard against bypassing git hooks via git commit/push --no-verify or -n. Known bypass classes include aliases, wrapper scripts, and non-standard clients. Fix the underlying hook failure instead of skipping validation.

• code-safetyopen-coder-ai

  trigger: secrets, eval/exec, unsanitized SQL, hallucinated dependencies. avoid: committing credentials, adding unverified packages, executing dynamic code.

Show the badge

owasp-asi06-memory-context-poisoning passed verification against the official 1.0.0 schema. Add the badge to your README to show it — it links readers to this verified listing.

[![Verified Agent Plugin](https://agentpluginsdirectory.com/badge.svg)](https://agentpluginsdirectory.com/plugins/owasp-asi06-memory-context-poisoning)