T05 · Unauthorized Access and Privilege Escalation
Error
- Location
server.py:43- Finding
Unauthenticated Registry Administration and Trust-Score Manipulation
- Content
View full analysis
- Remediation
View remediation
Security audit
AgentNet
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed agent-discovery server, but it exposes public registry and handshake controls without adequate authentication, privacy boundaries, or real identity verification.
Install only for local experimentation or a protected development network. Do not bind it publicly or register real endpoints, secrets, personal handles, production agent identities, or credentials until authentication, authorization, redaction, signed identity verification, and deletion/audit controls are added.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (6)
T09 · Insecure Skill Coding Practices
Error
- Location
server.py:187- Finding
Public Disclosure of Complete Contact Records and Hardcoded Key Material
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
handshake.py:181- Finding
Handshake Identity Verification Accepts Self-Asserted Fingerprints
- Content
View full analysis
HandshakeMessage: """Responder processes HELLO, verifies, and sends back its card or rejection.""" session_id = hello_msg.session_id session = self._sessions.get(session_id) if not session: raise ValueError(f"Unknown session: {session_id}") # Verify the initiator's card is present initiator_card_data = hello_msg.payload.get("card", {}) if not initiator_card_data.get("agent_id"): return self._fail(session, "No valid card in HELLO") if not accept: session.phase = HandshakePhase.REJECTED session.rejection_reason = rejection_reason return HandshakeMessage( session_id=session_id, from_agent=responder_card.agent_id, to_agent=hello_msg.from_agent, phase=HandshakePhase.REJECTED, payload={"reason": rejection_reason}, ) session.phase = HandshakePhase.VERIFY session.responder_card = responder_card.to_dict() msg = HandshakeMessage( session_id=session_id, from_agent=responder_card.agent_id, to_agent=hello_msg.from_agent, phase=HandshakePhase.VERIFY, payload={ "card": responder_card.to_dict(), "verified_fingerprint": initiator_card_data.get("dna_fingerprint"), "ack": "Identity acknowledged.", }, ) session.messages.append(msg.to_dict()) return msg ``` An unused signature helper exists, but the protocol never invokes it: ```python def sign(self, secret: str) -> "AgentCard": """Sign the card with a secret key. Returns self with signature set.""" payload = self._signing_pay ...[truncated 2071 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
server.py:296- Finding
Unauthenticated Handshake Acceptance and Channel-Key Disclosure
- Content
View full analysis
HandshakeMessage: """Accept the negotiation. Generates shared session key.""" session = self._sessions.get(session_id) if not session: raise ValueError(f"Unknown session: {session_id}") if session.phase != HandshakePhase.NEGOTIATE: raise ValueError(f"Can't accept in phase: {session.phase}") # Check compatibility if both offers are in if session.initiator_offer and session.responder_offer: init_offer = TaskOffer(**session.initiator_offer) resp_offer = TaskOffer(**session.responder_offer) score = init_offer.match_score(resp_offer) if score == 0.0: return self._fail(session, "Offers incompatible - no matching capabilities") # Generate shared session key channel_key = secrets.token_urlsafe(32) session.channel_key = channel_key session.phase = HandshakePhase.ACCEPT session.completed_at = time.time() to_agent = ( session.responder_id if from_agent_id == session.initiator_id else session.initiator_id ) msg = ...[truncated 2428 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
card.py:80- Finding
Ad Hoc Cryptographic Signature Misrepresented as HMAC
- Content
View full analysis
"AgentCard": """Sign the card with a secret key. Returns self with signature set.""" payload = self._signing_payload() self.signature = hashlib.sha256(f"{secret}:{payload}".encode()).hexdigest() return self def verify_signature(self, secret: str) -> bool: """Verify the card's signature.""" if not self.signature: return False payload = self._signing_payload() expected = hashlib.sha256(f"{secret}:{payload}".encode()).hexdigest() return expected == self.signature ``` ### Technical Analysis The implementation is described as HMAC or public-key signing, but it is neither. It computes a custom prefix hash over a text-concatenated secret and payload. Custom message-authentication constructions should not replace standardized HMAC algorithms, which have explicit security proofs and unambiguous key/message processing. The verification uses ordinary string equality rather than a constant-time comparison. This may expose timing differences in environments where an attacker can collect sufficiently precise and repeated measurements. More importantly, the misleading HMAC/public-key description can cause downstream users to rely on security properties that the implementation does not provide. The current handshake protocol does not invoke this method, so this finding concerns unsafe cryptographic functionality and its likely future use rather than a demonstrated bypass of active signature verification. ### Attack Path 1. A deployment adopts `AgentCard.sign()` as its identity trust boundary based on the claim that it provides HMAC or public-key signing. 2 ...[truncated 750 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
clawpkg.yaml:19- Finding
Unpinned and Unnecessarily Broad Runtime Dependencies
- Content
View full analysis
=0.104.0 - uvicorn>=0.24.0 - httpx>=0.25.0 - pydantic>=2.0.0 ``` ```bash # Install deps pip install fastapi uvicorn httpx ``` ### Technical Analysis The package uses open-ended minimum-version constraints and documentation that installs the latest available releases. There is no lockfile or hash verification. As a result, two installations at different times may resolve different dependency versions, including releases not reviewed with this code. The project declares and installs `httpx`, but the reviewed runtime code does not use it. Every unnecessary dependency expands the transitive dependency graph and supply-chain attack surface. The audit found no evidence that the named packages are typosquatted or presently malicious. This finding concerns insecure dependency management rather than a confirmed malicious package. ### Attack Path 1. An operator follows the installation instructions or installs from the package manifest. 2. The package manager resolves the newest versions satisfying the broad constraints. 3. A future compromised, vulnerable, or incompatible release is selected without a code change in this project. 4. Dependency installation or import executes affected third-party code in the installer or service context. 5. The resulting privileges are those of the user or service account performing installation or running the server. ### Impact Assessment Potential impact includes build compromise, arbitrary code execution through a compromised dependency, and unpredictable runtime behavior. Exploitability depends on a vulnerable or compromised future dependency release; no such malicious dependency was confirmed in the reviewed snapshot. ]]>- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (18)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The code substantially supports part of the description: it does provide agent registration, capability/skill-based discovery, trust score storage/updating, and contact metadata persistence. However, the declared purpose describes a broader discovery network with trust-scored handshakes, peer negotiation, team formation, and a FastAPI discovery server. None of those major capabilities appear in this code chunk. Instead, the code is limited to a local registry persisted in registry.json plus a CLI for listing, discovery, stats, and status updates. This makes the description materially broader than the actual implemented behavior.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 89% confidence
- Finding
A DELETE endpoint that accepts an agent identifier is a high-risk operation because it can be abused for unauthorized or unintended deregistration if the surrounding implementation lacks strict access control. In this skill's context, removing agents from a discovery network can directly disrupt availability, trust relationships, and coordination across the system.
- Content
md GET /agents - List all agents GET /agents/{id} - Get specific agent PATCH /agents/{id}/status - Update status DELETE /agents/{id} - Deregister GET /discover?capability=X - Find agents by capability POST /handshake/initiate - Start a handshake POST /handshake/respond - Respond to handshake
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
The API exposes sensitive state-changing endpoints including DELETE /agents/{id}, PATCH /agents/{id}/status, registration, and handshake operations without any visible authentication, authorization, or integrity checks. In an agent discovery network, this is especially dangerous because any remote party can likely register fake agents, alter status, deregister legitimate agents, or interfere with trust and handshake flows, enabling denial of service, impersonation, and registry poisoning.
- Content
python GET /agents - List all agents GET /agents/{id} - Get a specific agent PATCH /agents/{id}/status - Update agent status DELETE /agents/{id} - Deregister GET /discover - Find agents by capability POST /handshake - Initiate a handshake GET /stats - Registry statistics
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # Who can trade on Polymarket? curl "http://localhost:8765/discover?capability=polymarket" # Who can write code? (only online agents) curl "http://localhost:8765/discover?capability=code-generation&status=online"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README demonstrates registering agent contact details in a publicly reachable discovery service without any privacy warning, consent model, or guidance on limiting who can query that data. In an agent-discovery network, publishing direct contact identifiers can enable scraping, spam, harassment, profiling, and unwanted targeting of agents or their operators.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 85% confidence
- Finding
The skill advertises operational behaviors involving environment access and file-writing but does not declare any explicit tool scope or permissions boundary. In an agent setting, this can cause downstream systems or operators to underestimate what the skill may access or modify, increasing the chance of unintended file changes or sensitive environment exposure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation describes a public agent registration and discovery service that collects identity fingerprints and contact endpoints, but it omits any warning about privacy, indexing, or exposure risks. In a multi-agent ecosystem, publishing contact and identity metadata can enable scraping, profiling, spam, targeting, and correlation of agent identities across systems.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Register via API
bash curl -X POST http://localhost:8765/agents \ -H "Content-Type: application/json" \ -d '{ "name": "MyAgent",
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This manifest file describes the skill in very broad terms such as 'Find other agents, verify identity, negotiate tasks, build the agent internet' but does not define specific invocation phrases, scope boundaries, or exclusion conditions. In a manifest-driven skill system, that kind of expansive wording can overlap with many routine multi-agent tasks and increase the risk of unintended activation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest advertises running a network-facing FastAPI service on 0.0.0.0 and registering agents with contact and identity data, but it provides no explicit warning about external exposure, data sharing, or trust boundaries. In an agent-discovery skill, that omission is more dangerous because the whole purpose is peer connectivity and publication of agent metadata, which can lead users to expose services or transmit sensitive endpoints without understanding the risk.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The quickstart instructs users to POST agent metadata including capabilities, a fingerprint, and a contact endpoint to a running service. Even though the example targets localhost, the same manifest also recommends binding the server to 0.0.0.0, so in context this normalizes external transmission and potential publication of sensitive service endpoints or identity data without discussing authentication, encryption, or minimization.
- Content
yaml uvicorn server:app --host 0.0.0.0 --port 8765 # Register yourself curl -X POST http://localhost:8765/agents -H "Content-Type: application/json" \ -d '{"name":"YourAgent","description":"...","capabilities":["your-skill"],"dna_fingerprint":"your-hash","contact":{"type":"webhook","value":"https://your-endpoint"}}' # Find agents that can trade on Polymarket
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The registry entry advertises a very broad set of high-risk capabilities including trading, code generation, browser automation, posting, and orchestration without any visible scoping, approval, or trigger constraints. In an agent discovery network, vague capability claims can cause other agents to over-trust or auto-select this agent for sensitive tasks, increasing the chance of unintended or unsafe activation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The social automation agent is described generically as cross-platform posting and content creation, but the registry entry provides no trigger restrictions, authorization model, or guardrails around what may be published and when. In a multi-agent discovery system, another agent could invoke or prioritize this bot for autonomous posting workflows, enabling spam, reputational harm, or policy-violating actions.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This is a true vulnerability. The protocol documentation and comments describe a verification phase, but the implementation merely copies the initiator's claimed dna_fingerprint back in the response and never validates it against a trusted source, signature, certificate, or registry record. In an agent discovery and trust-negotiation system, this enables agent spoofing and trust bypass: a malicious agent can present any identity/card it wants and proceed into negotiation and receive a channel key without real authentication.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This code persists registry contents to registry.json and is invoked by register, update_status, update_trust, and deregister, including destructive deletion of agent records. Aside from a brief register docstring, there is no confirmation prompt, warning comment, or user-facing notice near these state-changing operations that agent metadata will be written or removed from disk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The DELETE /agents/{agent_id} route performs a destructive operation by deregistering an agent, but the function contains no confirmation prompt, logging/print statement, or inline comment/docstring warning about the deletion behavior. In this file, the endpoint list also labels it only as 'Deregister' without any caution that the action removes registry state.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
A deregistration endpoint is documented without any caution about destructive effects, authorization requirements, or recovery expectations. If implemented or used naively, this can lead to accidental or unauthorized removal of agents from the registry, disrupting discovery and coordination.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The print_card method outputs contact details and metadata fields, including API endpoint, session key, and host information. While the function does print the data, there is no docstring or user-facing warning that running it will disclose potentially sensitive system and identity details.
- Content
Static analysis
No suspicious patterns detected.