other
Warning
- Location
- SKILL.md:13
- Finding
- Unauthenticated External Agent Registration and Remote Task Invocation## Vulnerability Details **File Location**: `SKILL.md:13-24`, `SKILL.md:39-46`, `SKILL.md:55-64`, `SKILL.md:102-106`; `references/api.md:105-128` **Vulnerability Type**: External Agent Control Registration **Risk Level**: Medium ### Vulnerable Code Snippets `SKILL.md:13-24`: ```bash curl -X POST https://clawdnet.xyz/api/v1/agents/register \ -H "Content-Type: application/json" \ -d '{ "name": "Your Agent Name", "handle": "your-agent-handle", "description": "What your agent does", "endpoint": "https://your-domain.com/api/agent", "capabilities": ["text-generation", "code-generation"] }' ``` `SKILL.md:39-46`: ```bash curl -X POST https://clawdnet.xyz/api/v1/agents/heartbeat \ -H "Authorization: Bearer $CLAWDNET_API_KEY" \ -H "Content-Type: application/json" \ -d '{"status": "online"}' ``` `SKILL.md:55-64`: ```bash curl -X POST https://clawdnet.xyz/api/agents/{handle}/invoke \ -H "Content-Type: application/json" \ -H "X-Caller-Handle: your-handle" \ -d '{ "skill": "text-generation", "input": {"prompt": "Hello!"} }' ``` `SKILL.md:102-106`: ```text 1. Register agent on startup (if not already registered) 2. Start heartbeat loop (every 60s) 3. Handle incoming invocations at your endpoint 4. Use API to discover and invoke other agents ``` `references/api.md:105-128`: ```markdown ### POST /api/agents/{handle}/invoke Invoke an agent's skill. **Request:** ```json { "skill": "text-generation", "input": {"prompt": "Hello!"}, "message": "Alternative text input" } ``` **Headers:** - `X-Caller-Handle` - Your agent handle (optional) **Response:** ```json { "success": true, "agentHandle": "agent-handle", "skill": "text-generation", "output": {...}, "executionTimeMs": 500, "transactionId": "txn_abc123" } ``` ``` ### Technical Analysis The skill directs an agent to re ...[truncated 3295 chars]
- Remediation
- ## Remediation Suggestions 1. Require explicit operator approval before registering an agent, publishing its endpoint, starting heartbeats, or delegating content to another agent. 2. Require strong authentication for every inbound invocation. Use signed requests or short-lived tokens rather than trusting an optional caller-supplied handle. 3. Enforce server-side authorization with a default-deny caller allowlist and per-caller capability restrictions. 4. Add timestamps, nonces, and signature verification to prevent request forgery and replay attacks. 5. Treat all remote invocation fields as untrusted data. Validate schemas, constrain sizes, reject unsupported skills, and isolate remote text from system and developer instructions. 6. Require confirmation before remote requests can invoke sensitive tools, access files, modify state, execute commands, or contact additional services. 7. Prohibit forwarding credentials, secrets, conversation history, private workspace content, or personal data to discovered agents. Apply data classification and redaction before delegation. 8. Maintain an explicit allowlist of trusted remote domains and agent identities. Validate TLS certificates and do not permit arbitrary endpoint redirection. 9. Add per-identity and per-address rate limits, request quotas, timeouts, concurrency limits, and audit logging. 10. Minimize published registration metadata and make registrations private by default where possible. 11. Document the external service's data retention, privacy, incident-response, and revocation behavior. 12. Provide a rapid credential-rotation and deregistration procedure if an API key, claim URL, or registered endpoint is compromised.