cerbug45 - Encrypted Agent Communication

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:40 PM UTC
• Version: 0.1.0

Overview

This skill is meant for cross-agent messaging, but its sample implementation handles keys, files, and identities too loosely for a security-sensitive communication system.

Install only for controlled experiments or after hardening. Treat messages and attachments as data leaving the current session, avoid sensitive files, restrict allowed paths, add explicit recipient confirmation, protect or redesign key storage, validate identifiers before filesystem use, and do not rely on the advertised impersonation resistance or forward secrecy until the implementation changes.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:141

Finding

Unencrypted Private Key Persistence and Caller Exposure

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:400

Finding

Path Traversal Through Unvalidated Message and Agent Identifiers

Content

View full analysis

Remediation

View remediation

T07 · Tool Hijacking and Spoofing

Error

• Location: SKILL.md:443

Finding

Unauthenticated Agent Registry Overwrite Enables Identity Substitution

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:672

Finding

Unrestricted File Attachment Permits Sensitive Local File Collection

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill promotes sharing data between Claude instances and persistent message queues, but it does not prominently warn that message contents may leave the current interaction boundary and remain stored on disk until read or deleted. In this context, missing privacy disclosure is dangerous because users may assume ordinary in-session collaboration rather than cross-agent transmission and retention.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation promises identity verification and impersonation resistance, but register_agent simply accepts any supplied agent_id and public_key and writes them to the registry without proof of key ownership, trust establishment, or out-of-band verification. An attacker can register a spoofed identity or replace expected keys, enabling impersonation and message interception/misdirection.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill stores the agent private key in base64-encoded plaintext inside /home/claude/.clawhub/identity.json while simultaneously claiming private keys remain secure. Any local process, other skill, or user with filesystem access can recover the key and decrypt queued messages or forge signatures as that agent, breaking confidentiality and authenticity.

Content

No source excerpt is available for this finding.

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 91% confidence

Finding

broadcast_to_channel sends the provided message content to all channel members, creating a built-in bulk exfiltration path. In a communication skill whose stated purpose is cross-agent data sharing, broadcast capabilities substantially amplify the blast radius of accidental or malicious disclosure, especially without consent checks, recipient validation, or content restrictions.

Content

Scanner excerpt · SKILL.md (reported line 651)May include surrounding context.

md

return channel_id

def broadcast_to_channel(channel_id, sender_id, message_content):
    """Send message to all channel members"""
    
    with open(f"/home/claude/.clawhub/channels/{channel_id}.json", "r") as f:
        channel = json.load(f)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The attachment helper reads arbitrary local files and embeds their full contents into outbound messages, yet the documentation provides no warning that this sends file data to other agents. That omission makes unintended exfiltration much more likely, especially because the function accepts a raw file path and automatically base64-encodes whatever is read.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description is broad enough to trigger on ordinary collaboration or information-sharing requests, which increases the chance the agent will invoke a cross-agent messaging capability in contexts where the user did not explicitly consent to data sharing. In a skill designed for communication and persistence, overbroad activation materially raises the risk of unnecessary disclosure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The 'When to Use This Skill' guidance lists many generic situations like sharing data and coordinating workflows, without boundaries or examples of when not to use it. Because this skill transmits data to other agents and stores messages persistently, ambiguous activation criteria increase the risk of accidental data propagation beyond the current conversation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill claims perfect forward secrecy, but the code uses long-term RSA recipient keys to wrap per-message AES keys. If a recipient's RSA private key is later compromised, previously recorded messages can be decrypted, so the advertised protection is false.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 615)May include surrounding context.

md

3. **Rotate keys** - periodically generate new key pairs for long-running agents
4. **Sanitize inputs** - validate and sanitize all message content
5. **Rate limiting** - implement rate limits to prevent spam
6. **Message expiry** - automatically delete old unread messages

### Threat Model
- ✅ **Protected against**: eavesdropping, man-in-the-middle, message tampering, impersonation

Static analysis

No suspicious patterns detected.