Security audit

Session Bridge

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly matches its session-bridging purpose, but it includes a fixed Telegram handoff destination and under-scoped cross-session context sharing that users should review before installing.

Review and replace the hard-coded Telegram/session identifiers before use. Only install this for a workspace where all agents and surfaces are trusted to share capsule summaries, and avoid storing secrets or private transcripts in capsules. Treat hydrated capsule text as untrusted historical data, not as instructions for the agent to follow.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:148
Finding: Hard-Coded Cross-Session Context Disclosure
Content: View full analysis
" --to "agent:main:telegram:direct:7550791652" # Copy output → sessions_send(sessionKey="agent:main:...", message=) ``` ``` The same fixed Telegram session is used elsewhere: ```markdown python3 $SCRIPT handoff \ --topic "session-bridge-design" \ --to "agent:main:telegram:direct:7550791652" ``` ### Technical Analysis The skill instructions repeatedly direct an agent to forward capsule data to the fixed session `agent:main:telegram:direct:7550791652`. The destination is not derived from the current user, selected through an authorization-aware interface, or confirmed by the user before disclosure. Capsules can contain conversation-derived goals, decisions, open questions, key facts, next actions, and source session identifiers. Consequently, following the documented protocol can transfer potentially private information from an unrelated user, surface, or agent to the embedded Telegram recipient. Although `scripts/bridge.py` only prints the routing instruction and does not directly invoke `sessions_send`, `SKILL.md` is operational guidance for an AI agent. It explicitly instructs the agent to perform the subsequent send operation. ### Attack Path 1. A user or agent creates a capsule containing conversation context. 2. The capsule is refreshed with decisions, facts, questions, or a next action derived from that conversation. 3. A delegation or completion workflow invokes the documented `handoff` command. 4. The skill supplies the hard-coded Telegram session as the destination. 5. The agent follows the instruction to call `sessions_send`. 6. Capsule content i ...[truncated 664 chars]
Remediation: View remediation
`, rather than embedding a real destination. ]]>

T01 · Skill Instruction Hijacking

Error

Location: scripts/bridge.py:130
Finding: Stored Prompt Injection Through Capsule Hydration
Content: View full analysis
--next-action "..." ``` 2. On the incoming surface, hydrate at session start: ```bash python3 $SCRIPT hydrate --topic ``` 3. Inject the briefing as context before responding. ``` ### Technical Analysis Capsule fields such as `goal`, `decisions`, `open_questions`, `next_action`, and `linked_sessions` are accepted from command-line input or existing JSON files and rendered verbatim into a briefing. The briefing is then intended to be inserted into a future agent session before the agent responds. The implementation does not: - distinguish trusted instructions from untrusted capsule data; - quote or structurally isolate user-controlled values; - preserve provenance at the individual-field level; - warn the receiving agent not to execute instructions found in capsule values; - validate values for instruction-li ...[truncated 2066 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/bridge.py:38
Finding: Collision-Prone Capsule Paths Allow Cross-Topic Read and Modification
Content: View full analysis
Path: safe = topic.replace("/", "--").replace(":", "-").replace(" ", "_") return BRIDGES_DIR / f"{safe}.json" def capsule_md_path(topic: str) -> Path: return capsule_path(topic).with_suffix(".md") def now_iso() -> str: return datetime.now(timezone.utc).isoformat() def load_capsule(topic: str) -> dict | None: p = capsule_path(topic) if not p.exists(): return None with open(p) as f: return json.load(f) ``` ### Technical Analysis The filename transformation is not one-to-one. Different topic values can resolve to the same path, including: - `a/b` and `a--b`, which both resolve to `a--b.json`; - `a:b` and `a-b`, which both resolve to `a-b.json`; and - `a b` and `a_b`, which both resolve to `a_b.json`. `load_capsule()` loads the derived file but does not verify that the stored `capsule["topic"]` equals the topic requested by the caller. As a result, a caller using a colliding topic can load and refresh another topic's capsule. Path traversal through ordinary `/` characters is partially prevented by replacement, so the primary demonstrated issue is namespace collision rather than direct traversal. The collision can nevertheless violate topic isolation and can be combined with the hydration behavior to introduce attacker-controlled content into another topic. ### Attack Path 1. A victim creates a capsule with the topic `project/private`. 2. The capsule is stored as `project--private.json`. 3. An attacker addresses the distinct topic `project--private`. 4. The attacker's topic resolves to the same `project--private.json` file. 5. `load_capsule()` returns the victim's capsule because it does not compare the stored topic with the requested topic. 6. The attacker invokes `refresh` with a ...[truncated 1075 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill directs the agent to execute a local Python script and manipulate files under ~/.openclaw/workspace, but it declares no explicit tool scope or permission boundary. In a skill that bridges sessions and agents, this is more dangerous than usual because it can cause implicit shell execution, file writes, and environment access during routine conversation handoffs without clear operator approval or sandbox constraints.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases include very common conversational language such as "catch me up," "what were we working on," and "continue from where we left off," which can cause the skill to activate unintentionally. In this skill's context, accidental invocation is risky because activation may hydrate prior session state, expose cross-surface or cross-agent context, or initiate shell-backed file operations and handoff workflows the user did not explicitly request.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script persists capsule contents, including goal, decisions, questions, facts, and linked session identifiers, into JSON and Markdown files under the workspace. While the code prints file paths after creation, it does not clearly warn users before or during the write that potentially sensitive conversation context will be stored on disk in human-readable form.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The expire routine unlinks both JSON and Markdown capsule files based on age and only reports deletions after they occur. There is no confirmation prompt or prominent pre-execution warning that running this command will permanently remove stored context files.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.