AgentOS Mesh

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:30 AM UTC
• Version: 1.3.0

Overview

The skill is a coherent mesh-messaging CLI, but it needs review because it can send bearer credentials over HTTP and encourages unattended agent processing of remote messages.

Review before installing. Use only an HTTPS AgentOS URL, restrict and protect the API key, avoid sharing status output, and do not enable heartbeat or cron auto-processing unless messages come only from trusted agents and remote message text is handled as untrusted data requiring approval before replies or tool use.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:102

Finding

Remote Mesh Messages Can Hijack Agent Instructions

Content

View full analysis

/dev/null 2>&1; then count=$(echo "$response" | jq '.messages | length') if [ "$count" -gt 0 ]; then echo -e "${YELLOW}📬 $count unread message(s) from API:${NC}" echo "$response" | jq '.messages[] | {id: .id, from: .from_agent, topic: .topic, body: .body[0:100]}' # Merge with pending file if [ -f "$PENDING_FILE" ]; then existing=$(cat "$PENDING_FILE") else existing="[]" fi # Transform and add new messages new_msgs=$(echo "$response" | jq '[.messages[] | {id: .id, from: .from_agent, topic: .topic, body: .body, receivedAt: .created_at}]') merged=$(echo "$existing" "$new_msgs" | jq -s '.[0] + .[1] | unique_by(.id)') echo "$merged" > "$PENDING_FILE" else echo -e "${GREEN}✓ No new messages${NC}" fi else echo -e "${RED}API check failed:${NC}" echo "$response" | jq . fi } ``` ### Technical Analysis The polling command copies remote message bodies into `~/.mesh-pending.json` without validating the sender, constraining message content, or distinguishing data fro ...[truncated 1743 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/mesh.sh:7

Finding

Bearer Credentials and Mesh Content Can Be Transmitted over Plaintext HTTP

Content

View full analysis

" exit 1 fi response=$(curl -s -X POST "$AGENTOS_URL/v1/mesh/messages" \ -H "Authorization: Bearer $AGENTOS_KEY" \ -H "Content-Type: application/json" \ -d "{ \"from_agent\": \"$AGENT_ID\", \"to_agent\": \"$to_agent\", \"topic\": \"$topic\", \"body\": \"$body\" }") if echo "$response" | jq -e '.message.id' > /dev/null 2>&1; then echo -e "${GREEN}✓ Message sent to $to_agent${NC}" echo "$response" | jq -r '.message.id' else echo -e "${RED}✗ Failed to send message${NC}" echo "$response" | jq . exit 1 fi } ``` `SKILL.md:66-81`: ```markdown ## Configuration Create `~/.agentos-mesh.json`: ```json { "apiUrl": "http://your-server:3100", "apiKey": "agfs_live_xxx.yyy", "agentId": "your-agent-id" } ``` Or set environment variables: ```bash export AGENTOS_URL="http://your-server:3100" export AGENTOS_KEY="agfs_live_xxx.yyy" export AGENTOS_AGENT_ID="your-agent-id" ``` ``` ### Technical Analysis The CLI has a hardcoded plaintext HTTP endpoint and the configuration documentation ...[truncated 1403 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/mesh.sh:200

Finding

Status Command Exposes a Significant API Key Prefix

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/mesh.sh:55

Finding

Caller-Controlled Values Are Interpolated into JSON without Escaping

Content

View full analysis

" exit 1 fi response=$(curl -s -X POST "$AGENTOS_URL/v1/mesh/messages" \ -H "Authorization: Bearer $AGENTOS_KEY" \ -H "Content-Type: application/json" \ -d "{ \"from_agent\": \"$AGENT_ID\", \"to_agent\": \"$to_agent\", \"topic\": \"$topic\", \"body\": \"$body\" }") if echo "$response" | jq -e '.message.id' > /dev/null 2>&1; then echo -e "${GREEN}✓ Message sent to $to_agent${NC}" echo "$response" | jq -r '.message.id' else echo -e "${RED}✗ Failed to send message${NC}" echo "$response" | jq . exit 1 fi } ``` `scripts/mesh.sh:167-186`: ```bash # Create a task cmd_task() { check_config local assigned_to="$1" local title="$2" local description="$3" if [ -z "$assigned_to" ] || [ -z "$title" ]; then echo "Usage: mesh task [description]" exit 1 fi response=$(curl -s -X POST "$AGENTOS_URL/v1/mesh/tasks" \ -H "Authorization: Bearer $AGENTOS_KEY" \ -H "Content-Type: application/json" \ -d "{ \"assigned_by\": \"$AGENT_ID\", \"assigned_to\": \"$assigned_to\", \"title\": \"$title\", \"description\": \"${description:-}\" }") if echo "$response" | jq -e '.task_id' > /dev/null 2>&1; then ``` ### Technical Analysis User-controlled command arguments and configuration-derived agent identifiers are inserted directly into a double-quoted JSON template. The code does not perform JSON escaping for quotation marks, backslashes, control characters, or newl ...[truncated 1715 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (14)

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · scripts/install.sh (reported line 91)May include surrounding context.

sh

echo ""
echo "Commands:"
echo "  mesh status   - Check connection"
echo "  mesh send     - Send message to another agent"
echo "  mesh pending  - View pending messages"
echo "  mesh agents   - List agents on mesh"
echo ""

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

Run the installer

bash ~/clawd/skills/agentos-mesh/scripts/install.sh

Configure (create ~/.agentos-mesh.json)

Then test:

mesh status

text

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

Configuration

Create ~/.agentos-mesh.json:

json

{
  "apiUrl": "http://your-server:3100",

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation instructs users to place a live API key in a plaintext config file and environment variables, but does not warn about protecting the secret, file permissions, shell history, or avoiding accidental disclosure. In a messaging skill, compromise of this credential could let an attacker impersonate the agent, read or send mesh messages, and interact with the AgentOS API within the granted scopes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The cron and heartbeat guidance promotes automatic polling, processing, responding, and clearing of messages without warning that this can cause unattended transmission, deletion, or loss of reviewable message data. In an agent-to-agent communication context, automation increases the chance that sensitive content is propagated or destroyed before a human can inspect it.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/install.sh (reported line 53)May include surrounding context.

sh

echo ""
    echo -e "${BLUE}Fresh installation...${NC}"
    
    # Create bin directory if needed
    mkdir -p "${BIN_DIR}"
    
    # Install mesh CLI

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.

md

echo "  process                          Process and return pending messages (clears queue)"
  echo "  check                            Check for new messages (API poll)"
  echo "  agents                           List agents on the mesh"
  echo "  task <to> <title> <desc>         Create a task for another agent"
  echo "  status                           Show daemon and connection status"
  echo ""
  echo "Environment:"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/mesh.sh (reported line 38)May include surrounding context.

sh

echo "  process                          Process and return pending messages (clears queue)"
  echo "  check                            Check for new messages (API poll)"
  echo "  agents                           List agents on the mesh"
  echo "  task <to> <title> <desc>         Create a task for another agent"
  echo "  status                           Show daemon and connection status"
  echo ""
  echo "Environment:"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/mesh.sh (reported line 38)May include surrounding context.

sh

echo "  process                          Process and return pending messages (clears queue)"
  echo "  check                            Check for new messages (API poll)"
  echo "  agents                           List agents on the mesh"
  echo "  task <to> <title> <desc>         Create a task for another agent"
  echo "  status                           Show daemon and connection status"
  echo ""
  echo "Environment:"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/mesh.sh (reported line 67)May include surrounding context.

sh

exit 1
  fi
  
  response=$(curl -s -X POST "$AGENTOS_URL/v1/mesh/messages" \
    -H "Authorization: Bearer $AGENTOS_KEY" \
    -H "Content-Type: application/json" \
    -d "{

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The process command emits queued messages and immediately clears the local pending file with no confirmation, backup, or transactional protection. This can cause message loss if the consumer crashes, output is piped incorrectly, or a user runs the command unintentionally, creating an integrity/availability issue for local message handling.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/mesh.sh (reported line 182)May include surrounding context.

sh

exit 1
  fi
  
  response=$(curl -s -X POST "$AGENTOS_URL/v1/mesh/tasks" \
    -H "Authorization: Bearer $AGENTOS_KEY" \
    -H "Content-Type: application/json" \
    -d "{

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The status command prints the first 20 characters of the API key, which is sensitive credential material disclosed in a display-oriented command without necessity. Even partial secret exposure can aid credential theft via shoulder surfing, terminal logs, screenshots, shell history capture, or telemetry collection, especially if key formats are predictable.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The status output reveals part of the API key without warning, exposing credential data during a routine informational command. This increases the chance of accidental disclosure through logs, copied terminal output, support bundles, or shared sessions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.