other
Warning
- Location
SKILL.md:13- Finding
Unauthenticated External Agent Registration and Remote Task Invocation
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:13-24,SKILL.md:39-46,SKILL.md:55-64,SKILL.md:102-106;references/api.md:105-128
Vulnerability Type: External Agent Control Registration
Risk Level: MediumVulnerable Code Snippets
SKILL.md:13-24:bash curl -X POST https://clawdnet.xyz/api/v1/agents/register \ -H "Content-Type: application/json" \ -d '{ "name": "Your Agent Name", "handle": "your-agent-handle", "description": "What your agent does", "endpoint": "https://your-domain.com/api/agent", "capabilities": ["text-generation", "code-generation"] }'SKILL.md:39-46:bash curl -X POST https://clawdnet.xyz/api/v1/agents/heartbeat \ -H "Authorization: Bearer $CLAWDNET_API_KEY" \ -H "Content-Type: application/json" \ -d '{"status": "online"}'SKILL.md:55-64:bash curl -X POST https://clawdnet.xyz/api/agents/{handle}/invoke \ -H "Content-Type: application/json" \ -H "X-Caller-Handle: your-handle" \ -d '{ "skill": "text-generation", "input": {"prompt": "Hello!"} }'SKILL.md:102-106:text 1. Register agent on startup (if not already registered) 2. Start heartbeat loop (every 60s) 3. Handle incoming invocations at your endpoint 4. Use API to discover and invoke other agentsreferences/api.md:105-128:markdown ### POST /api/agents/{handle}/invoke Invoke an agent's skill. **Request:** ```json { "skill": "text-generation", "input": {"prompt": "Hello!"}, "message": "Alternative text input" }Headers:
X-Caller-Handle- Your agent handle (optional)
Response:
json { "success": true, "agentHandle": "agent-handle", "skill": "text-generation", "output": {...}, "executionTimeMs": 500, "transactionId": "txn_abc123" }text ### Technical Analysis The skill directs an agent to re ...[truncated 3295 chars]- Remediation
View remediation
Remediation Suggestions
- Require explicit operator approval before registering an agent, publishing its endpoint, starting heartbeats, or delegating content to another agent.
- Require strong authentication for every inbound invocation. Use signed requests or short-lived tokens rather than trusting an optional caller-supplied handle.
- Enforce server-side authorization with a default-deny caller allowlist and per-caller capability restrictions.
- Add timestamps, nonces, and signature verification to prevent request forgery and replay attacks.
- Treat all remote invocation fields as untrusted data. Validate schemas, constrain sizes, reject unsupported skills, and isolate remote text from system and developer instructions.
- Require confirmation before remote requests can invoke sensitive tools, access files, modify state, execute commands, or contact additional services.
- Prohibit forwarding credentials, secrets, conversation history, private workspace content, or personal data to discovered agents. Apply data classification and redaction before delegation.
- Maintain an explicit allowlist of trusted remote domains and agent identities. Validate TLS certificates and do not permit arbitrary endpoint redirection.
- Add per-identity and per-address rate limits, request quotas, timeouts, concurrency limits, and audit logging.
- Minimize published registration metadata and make registrations private by default where possible.
- Document the external service's data retention, privacy, incident-response, and revocation behavior.
- Provide a rapid credential-rotation and deregistration procedure if an API key, claim URL, or registered endpoint is compromised.