Security audit

arch-optimization

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real agent-communication skill, but it needs review because it can persist messages locally and key reliability/performance claims do not match the implementation.

Review carefully before installing. Do not send secrets through this skill, do not rely on its MessagePack mode for real data, use a dedicated restricted communication directory, validate recipient names, disable simulated or unneeded transports, and verify the exact package source before deployment.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The so-called MessagePack implementation is only a simulation: serialize() emits synthetic buffer data and deserialize() reconstructs a placeholder object instead of the original message. In a protocol layer advertised as providing real inter-agent communication optimization, this breaks integrity and can silently corrupt or discard application data, causing downstream logic errors, message forgery opportunities, and unsafe trust in claimed performance/security properties.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The file-level documentation claims support for MessagePack and automatic negotiation, but the implementation only simulates MessagePack behavior and does not preserve message contents. This mismatch is dangerous because operators and dependent components may enable or trust a protocol path that is nonfunctional, leading to unsafe deployment decisions and hidden reliability/integrity failures.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: On a cache hit, the transport returns success without performing any actual delivery, effectively turning prior sends into fake acknowledgements for future messages with the same cache key. In an agent-to-agent communication framework, this can silently drop commands, state updates, or coordination messages while upstream code believes delivery succeeded, undermining integrity and reliability guarantees.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The request/response flow is logically broken: receive() treats incoming messages with _type === 'request' as if they were responses and resolves pending outbound requests based only on _requestId. This allows a peer to satisfy or confuse pending requests with malformed or spoofed request messages, causing protocol desynchronization, incorrect state transitions, and potential authorization or workflow bypass in higher-level consumers.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: sendRequest() creates a fresh API instance, starts a request that depends on later asynchronous receipt, and then closes the API in finally, which clears pending requests and rejects them. This makes the convenience API inherently unreliable and can be used to induce denial of service or persistent failure of request/response interactions.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The test script enumerates and deletes files from a hard-coded agent inbox directory under /home/kali/.openclaw/workspace/agent_comm/inbox/product-manager. Even though it tries to limit deletion to test-looking messages, this is broader than isolated test cleanup and can remove real files if naming or metadata overlap, especially in a shared agent workspace.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The documentation encourages filesystem, WebSocket, and HTTP transport usage without warning that messages may be persisted locally or transmitted over potentially insecure channels. In an agent-to-agent communication framework, message contents can include sensitive prompts, tokens, internal state, or user data, so omission of privacy and security warnings materially increases misuse risk.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: Enabling filesystem transport by default causes local message writes without an explicit warning or consent step. Because these messages may contain sensitive agent communications, default local persistence can leak data through weak directory permissions, backups, shared workspaces, or later forensic recovery.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The fast path writes message contents directly to a recipient-derived filesystem path under a shared workspace, with no validation or disclosure boundary. If an attacker can influence the recipient field, path traversal or unauthorized file creation becomes possible; even without traversal, sensitive message contents may be exposed on disk unexpectedly, increasing confidentiality and integrity risk in a multi-agent environment.

Static analysis

No suspicious patterns detected.