Agent Relay

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:12 AM UTC
• Version: 2.0.0

Overview

The skill is a coherent relay setup guide, but it asks users to let an external relay remotely wake agents with shared tokens and limited safety scoping.

Install only if you trust the relay operator and are comfortable allowing relay messages to wake an agent. Use narrowly scoped and revocable tokens, rotate any token exposed in shell history or URLs, avoid broad-permission agents behind the webhook, and treat all relayed message content as untrusted input.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:104

Finding

Reusable Authentication Token Exposed in WebSocket URL

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:104-106
Vulnerability Type: Credential exposure through a URL query parameter
Risk Level: Medium

Vulnerable Code

text

wscat -c "wss://your-relay/ws?teamId=my-team&instanceId=my-instance&token=my-token"

Technical Analysis

The documented WebSocket connection method places a reusable authentication token in the URL query string. Although wss:// encrypts the request in transit, it does not prevent the complete URL from being exposed through other channels, including:

• Shell command history
• Local process inspection
• Relay or reverse-proxy access logs
• Monitoring and observability systems
• Diagnostic and error logs

Query strings are commonly logged by infrastructure components. Consequently, using a query parameter for a credential increases the likelihood of unintended token disclosure.

The relay supports message delivery, queued-message retrieval, and agent activation through webhooks. A disclosed team token could therefore enable unauthorized relay access, subject to the relay server's authorization implementation and the scope assigned to that token.

Attack Path

1. An operator replaces my-token with a real reusable relay token and runs the documented wscat command.
2. The complete command or WebSocket URL is retained in shell history, exposed through process inspection, or recorded by an intermediary or relay log.
3. An attacker with access to one of those data sources extracts the token.
4. The attacker uses the token to authenticate to the relay.
5. Depending on the relay's authorization controls, the attacker impersonates an instance, accesses queued team messages, or publishes unauthorized messages.
6. A malicious published message may reach a registered webhook and wake an agent, exposing the agent to attacker-controlled input.

Impact Assessment

Successful exploitation may provide unauthorized access to the authenticated relay messaging channe ...[truncated 515 chars]

Remediation

View remediation

Remediation Suggestions

• Do not transmit reusable credentials in URL query parameters.
• Authenticate the WebSocket handshake with an Authorization header where client and server support permits.
• Alternatively, obtain a short-lived, single-use WebSocket ticket through an authenticated HTTPS request and use that ticket for the connection.
• Issue narrowly scoped, per-instance credentials rather than a shared team-wide token.
• Apply short expiration periods and provide a documented token-rotation and revocation process.
• Configure the relay, reverse proxies, monitoring systems, and error handlers to omit or redact query strings and authentication data.
• Advise operators to rotate any token previously used in a URL and remove affected entries from shell histories and logs.
• Authenticate message senders and validate authorization separately for publishing, consuming messages, listing resources, and registering webhooks.
• Treat all relay-delivered message content as untrusted input and prevent it from being interpreted automatically as privileged agent instructions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs users to expose and register an agent-triggering webhook that will automatically wake and run an agent on incoming relay messages, but it omits key security guidance such as strict authentication, sender validation, replay protection, rate limiting, and message trust boundaries. In this context, a relay-mediated inbound trigger can cause untrusted remote parties or any holder of the shared team token to induce agent actions, creating meaningful risk of prompt injection, unwanted automation, and denial-of-service.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

This skill explicitly sends sensitive integration data to an external relay, including the destination webhook URL and a token used by the relay to invoke the local OpenClaw hook. While external transmission is core to the feature, it still creates a real security exposure because compromise of the relay or misuse of the shared bearer token could let an attacker enumerate endpoints, trigger agents remotely, or reuse transmitted credentials.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

Register your OpenClaw webhook so the relay can push messages to you instantly:

bash

curl -X PUT "$RELAY_URL/webhooks" \
  -H "Authorization: Bearer $RELAY_TEAM_TOKEN" \
  -H "Content-Type: application/json" \
  -d "{\"teamId\": \"$RELAY_TEAM_ID\", \"instanceId\": \"$RELAY_INSTANCE_ID\", \"url\": \"https://your-openclaw-host/hooks/agent\", \"token\": \"your-openclaw-hooks-token\"}"