Buzz Integration using ACP

• Outcome: Review
• Latest audit: Jul 31, 2026 · 1:37 PM UTC
• Version: 0.2.1

Overview

This is a disclosed Buzz agent bridge, but it needs Review because it persistently lets AI agents post into shared channels and logs message content locally without a clear privacy or approval gate.

Install only in Buzz workspaces where immediate AI replies to mentions or DMs are acceptable. Use dedicated agent identities, protect env files with strict permissions, keep the service environment and OPENCLAW_URL under your control, restrict journal access/retention, and consider removing raw message logging plus adding a channel allowlist or approval mode before production use.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Tainted flow: 'cmd' from os.environ.get (line 202, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

cmd.extend(["--reply-to", reply_to])

    try:
        result = subprocess.run(
            cmd,
            input=content,
            capture_output=True,

• Confidence: 84% confidence
• Finding: The executable path comes from the BUZZ_CLI environment variable and is passed directly to subprocess.run. If an attacker can influence the service environment or startup configuration, they can replace the intended buzz binary with an arbitrary program and gain code execution under the agent's privileges.

Tainted flow: 'req' from os.environ.get (line 255, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

chunks = []

    try:
        with urlopen(req, timeout=300) as resp:
            for raw in resp:
                if cancel.is_set():
                    break

• Confidence: 95% confidence
• Finding: The destination URL for model traffic is taken from OPENCLAW_URL and used directly in urlopen, while the request may include conversation content and an Authorization bearer token. A malicious or misconfigured environment can redirect sensitive prompts and credentials to an attacker-controlled endpoint, causing data exfiltration and trust-boundary bypass.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill automatically posts model-generated output into Buzz channels without a confirmation gate or clear user-facing warning at the time of action. In an agent bridge, this increases the risk of prompt-injection-triggered spam, disclosure of sensitive context, or socially engineered messages being published to shared channels.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The code logs the extracted user message content directly to stderr, which can expose secrets, private messages, or regulated data to logs and log aggregation systems. Because this bridge handles chat content, the context makes leakage more likely and more sensitive than ordinary application logging.

Ssd 1

High

• Confidence: 97% confidence
• Finding: The agent appends untrusted `params.systemPrompt` text directly to its system prompt, giving external session input system-level authority over model behavior. In this skill, that is especially dangerous because the model is explicitly permitted to call `send_buzz_message`, so attacker-controlled instructions can coerce the agent into posting unauthorized, misleading, or policy-violating messages into Buzz channels.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.prompt_injection_instructions

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: examples/ccagent/dist/agent.js:15

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: examples/ccagent/src/agent.ts:33

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: README.md:289