Buzz Integration using ACP

• Outcome: Review
• Latest audit: Jul 23, 2026 · 9:28 AM UTC
• Version: 0.1.1

Overview

The skill matches its stated purpose, but it sets up always-on agents that can run shell commands without approval while using private keys and API keys.

Install only on a dedicated, low-privilege machine or container with no unrelated secrets. Use dedicated Buzz and model API keys, restrict env files to the service user, rotate any exposed keys, and avoid the Claude/Bash bypass pattern unless you can sandbox it or limit it to exact Buzz CLI commands. Do not run unsigned desktop installers unless you can verify the release source and checksum.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill clearly instructs users to run shell commands, configure environment variables, and connect to network services, but it does not declare corresponding permissions. That mismatch reduces transparency and prevents users or platforms from making informed trust decisions before installation or execution.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The documented behavior goes beyond simple agent deployment and includes external HTTP calls, persistent session handling, and examples that enable command execution through Claude-backed agents. This is dangerous because users may trust the stated purpose while overlooking that the setup can operate as a shell-capable autonomous agent with posting ability inside their environment.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The agent forwards user-controlled prompts to Claude while enabling the Bash tool with `permissionMode: "bypassPermissions"` and `allowDangerouslySkipPermissions: true`, which removes approval barriers for shell execution. In this skill's context, the model can be induced to run arbitrary commands in the provided working directory or host environment, and the embedded harness prompt explicitly teaches it to use shell commands to publish replies, making prompt-to-command abuse materially more dangerous than a display-only agent.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README explicitly requires Bash tool access together with bypassed permissions so an unattended agent can execute `buzz messages send` and other shell commands without human approval. In this architecture, prompts originate from a shared workspace and may be influenced by other users or prior context, so granting unrestricted shell execution materially increases the risk of prompt-injection-driven command execution, secret exposure, or host compromise.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The instructions direct users to place private keys and API keys into environment files without a prominent warning about secret handling, rotation, and exposure risk. In an agent-management skill, these credentials can grant relay membership, agent identity control, and access to external model services if leaked.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The desktop client instructions explicitly tell users to bypass a Windows SmartScreen warning for an unsigned binary without a balancing integrity-verification or trust warning. This normalizes overriding platform security controls and increases the chance users will run tampered or unverified executables.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The troubleshooting guidance explicitly tells users to bypass Windows SmartScreen for an unsigned installer without a clear warning that unsigned binaries have not been identity-verified and could be tampered with or replaced. This normalizes overriding an operating system security control and increases the chance users will run a malicious or substituted executable, especially in self-hosted or informal distribution workflows.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The code explicitly configures unattended shell execution with permission skipping but provides no runtime warning, consent gate, or audit-oriented acknowledgment at the point of use. Because this agent is intended to run under systemd without interactive approval, operators may not realize that any model-followed instruction reaching the Bash tool can execute immediately, increasing the chance of silent misuse or harmful automation.

Credential Access

High

• Category: Privilege Escalation

Content

Run `docker compose up -d minio-init` before starting the relay.

**Relay shows "Using hardcoded dev relay keypair"**
`BUZZ_RELAY_PRIVATE_KEY` not being read. Use systemd `EnvironmentFile=` or `export $(grep -v '^#' .env | xargs)` before running manually.

• Confidence: 89% confidence
• Finding: .env

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: README.md:265