ClawHub
Back to skill

Security audit

Agent Communication

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real agent messaging tool, but it exposes unauthenticated network messaging and unsafe local file access that need review before installation.

Install only in an isolated, trusted environment unless it is updated to bind to localhost by default, authenticate agents, use secure transport for remote access, validate all IDs and workspace keys before filesystem access, and document retention/deletion of stored messages and workspace data. Avoid sending secrets or sensitive prompts through this broker as packaged.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/broker.py:22
Finding

Unauthenticated Network-Accessible WebSocket Broker Permits Agent Impersonation

Content
View full analysis

Vulnerability Details

File Location: scripts/broker.py:22-23, scripts/broker.py:40-44, scripts/broker.py:144-181, and scripts/broker.py:217
Vulnerability Type: Missing authentication and authorization
Risk Level: High

Vulnerable Code

python
HOST = "0.0.0.0"
PORT = 8765
python
async def register_agent(self, agent_id: str, websocket: websockets.WebSocketServerProtocol):
    """Register Agent"""
    self.agents[agent_id] = websocket
    self.connections.add(websocket)
    print(f"[REGISTER] Agent '{agent_id}' connected")
python
async def handle_connection(self, websocket: websockets.WebSocketServerProtocol):
    """Handle connection"""
    agent_id = None

    try:
        async for data in websocket:
            try:
                msg = json.loads(data)

                # Register
                if msg.get("type") == "register":
                    agent_id = msg.get("agent_id")
                    await self.register_agent(agent_id, websocket)
                    await websocket.send(json.dumps({
                        "type": "registered",
                        "agent_id": agent_id,
                        "status": "online"
                    }))

                # Send message
                elif msg.get("type") == "send":
                    result = await self.send_message(
                        msg.get("from", "unknown"),
                        msg.get("to"),
                        msg.get("message"),
                        msg.get("priority", "normal")
                    )
                    await websocket.send(json.dumps(result))

                # Broadcast message
                elif msg.get("type") == "broadcast":
                    result = await self.broadcast_message(
                        msg.get("from", "unknown"),
                        msg.get("message"),
                        msg.ge
...[truncated 2795 chars]
Remediation
View remediation

Remediation Suggestions

  1. Bind to 127.0.0.1 by default unless remote access is explicitly required.
  2. Use authenticated wss:// transport for non-loopback communication.
  3. Require a securely provisioned credential, mutually authenticated TLS certificate, or signed short-lived token during registration.
  4. Associate each authenticated connection with one server-verified identity.
  5. Ignore or reject client-supplied from values. Derive the sender from the authenticated connection.
  6. Reject unauthorized recipients and broadcast targets according to an explicit access-control policy.
  7. Define safe duplicate-registration behavior instead of silently replacing an existing connection.
  8. Restrict the status query to authorized clients and disclose only necessary information.
  9. Add per-client connection, message-rate, payload-size, and queue limits.
  10. Add security tests covering unauthenticated registration, identity collisions, sender spoofing, unauthorized status queries, and forged broadcasts.

T09 · Insecure Skill Coding Practices

Error
Location
scripts/broker.py:74
Finding

Path Traversal Through Agent Identifiers and Workspace Keys

Content
View full analysis

Vulnerability Details

File Location: scripts/broker.py:74-78, scripts/broker.py:133-140, scripts/send.py:66-71, scripts/status.py:24-28, scripts/status.py:74-77, scripts/workspace.py:46-49, scripts/workspace.py:63-69, and scripts/workspace.py:92-98
Vulnerability Type: Path traversal and unsafe filesystem access
Risk Level: High

Vulnerable Code

scripts/broker.py:74-78:

python
status_file = DATA_DIR / "status" / f"{agent_id}.json"
status_file.parent.mkdir(parents=True, exist_ok=True)
with open(status_file, "w") as f:
    json.dump(status_msg, f, indent=2)

scripts/broker.py:133-140:

python
inbox_dir = DATA_DIR / "messages" / msg["to"] / "inbox"
inbox_dir.mkdir(parents=True, exist_ok=True)

msg_file = inbox_dir / f"{msg['id']}.json"
with open(msg_file, "w") as f:
    json.dump(msg, f, indent=2, ensure_ascii=False)

scripts/send.py:66-71:

python
inbox_dir = MESSAGES_DIR / to / "inbox"
inbox_dir.mkdir(parents=True, exist_ok=True)

msg_file = inbox_dir / f"{msg_id}.json"
with open(msg_file, "w") as f:
    json.dump(msg_data, f, indent=2, ensure_ascii=False)

scripts/status.py:24-28 and scripts/status.py:74-77:

python
status_file = STATUS_DIR / f"{agent_id}.json"

if status_file.exists():
    with open(status_file) as f:
        return json.load(f)
python
status_file = STATUS_DIR / f"{agent_id}.json"
with open(status_file, "w") as f:
    json.dump(status_data, f, indent=2)

scripts/workspace.py:46-49, scripts/workspace.py:63-69, and scripts/workspace.py:92-98:

python
data_file = WORKSPACE_DIR / f"{key}.json"
with open(data_file, "w") as f:
    json.dump(data, f, indent=2, ensure_ascii=False)
python
data_file = WORKSPACE_DIR / f"{key}.json"

if data_file.exists():
    with open(data_file) as f:
        return json.load(f)
python
data_file = WORKSPACE_DIR 
...[truncated 3094 chars]
Remediation
View remediation

Remediation Suggestions

  1. Apply a strict allowlist to every agent ID, recipient, and workspace key. For example, accept only ASCII letters, digits, underscores, and hyphens with a maximum length of 64 characters.
  2. Reject empty values, absolute paths, path separators, null characters, . components, and .. components.
  3. Resolve both the storage root and candidate path, then verify that the candidate remains beneath the intended root before every read, write, directory creation, or deletion.
  4. Centralize validation and safe path construction in one helper used by the broker, sender, status tool, and workspace tool.
  5. Do not derive filesystem paths directly from externally meaningful identities. Prefer an internal identifier or a cryptographic hash as the directory or filename.
  6. Use restrictive file and directory permissions and run the broker under a dedicated, unprivileged operating-system account.
  7. Avoid following symbolic links where practical and consider secure file-opening flags for security-sensitive deployments.
  8. Add tests for relative traversal, absolute paths, nested separators, symbolic-link escapes, excessively long identifiers, and invalid Unicode separators.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/broadcast.py:26
Finding

Incorrect Broadcast Argument Ordering Causes Message Misrouting and Exposes Message Text as a Path Component

Content
View full analysis

Vulnerability Details

File Location: scripts/broadcast.py:26-29; affected function signature at scripts/send.py:81
Vulnerability Type: Incorrect argument ordering and unsafe data-flow
Risk Level: Medium

Vulnerable Code

scripts/broadcast.py:26-29:

python
for agent in agents:
    result = send_message(agent, message, priority, from_agent)
    results.append(result)
    if result.get("success"):
        success_count += 1

The invoked function is declared in scripts/send.py:81 as:

python
def send_message(from_agent: str, to: str, message: str, priority: str = "normal", prefer_websocket: bool = True) -> dict:

Technical Analysis

The positional arguments do not match the send_message signature. The current call maps values as follows:

  • Intended target agent becomes from_agent.
  • Broadcast message becomes to.
  • Requested priority becomes message content.
  • Requested from_agent becomes the priority value.

This causes broadcast messages to be misrouted and misrepresented. If WebSocket delivery fails or file mode is used through the fallback, the original broadcast message becomes the recipient used by:

python
inbox_dir = MESSAGES_DIR / to / "inbox"

As a result, message text containing traversal components can reach the filesystem path construction defect in send.py.

The included test checks only whether the subprocess exits successfully. It does not verify sender, recipient, message content, priority, or the resulting filesystem path, so this defect can be reported as a successful broadcast.

Attack Path

  1. A caller invokes broadcast.py with a crafted message and one or more target agents.
  2. broadcast_message passes the values to send_message in the wrong order.
  3. The crafted message is interpreted as the recipient instead of message content.
  4. If WebSocket delivery is unavailable or fails, send_message falls ba ...[truncated 870 chars]
Remediation
View remediation

Remediation Suggestions

  1. Correct the call by using explicit keyword arguments:
    python
    result = send_message(
    from_agent=from_agent,
    to=agent,
    message=message,
    priority=priority
)
  2. Prefer keyword arguments for security-relevant functions with multiple parameters of the same type.
  3. Validate each target agent before invoking the sender.
  4. Apply the path-containment controls described in the path-traversal finding so argument-order defects cannot become filesystem vulnerabilities.
  5. Update broadcast tests to assert the exact sender, recipient, message, priority, delivery method, and destination path.
  6. Treat partial or total delivery failure as a failed broadcast rather than returning "success": true unconditionally.
  7. Add regression tests for WebSocket success, WebSocket failure with file fallback, multiple recipients, and traversal-like message content.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (26)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The natural-language instructions and descriptions in this skill are presented only in Chinese, which effectively forces a specific language on users. There is no opt-in, alternate language option, or explanation that this skill is intended solely for a Chinese-speaking or region-specific audience.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The README promotes real-time WebSocket messaging, broadcast, shared workspace, status sync, and offline message queues, but it does not mention privacy, retention, access control, or the sensitivity of inter-agent data. In an agent-to-agent communication skill, these features can carry task data, credentials, prompts, or other sensitive context, so omitting data-handling warnings increases the risk of unsafe deployment and accidental exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The configuration example instructs users to bind the WebSocket server to 0.0.0.0, which exposes the service on all network interfaces, but the README provides no warning about network exposure or the need for authentication and firewall restrictions. For a message broker handling agent traffic, broad binding can allow unintended remote access, message injection, impersonation, surveillance of agent coordination, or abuse of the broker if deployed outside a strictly isolated environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill advertises shared workspace and offline message queuing but provides no warning that messages and files may persist on disk and be visible to other agents or operators. In an agent-to-agent communication skill, this omission can cause users to place sensitive prompts, credentials, or proprietary data into storage mechanisms they may incorrectly assume are ephemeral or private.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The setup and usage instructions promote WebSocket-based messaging without any warning that agent messages traverse a network channel and may be intercepted, logged, or sent unencrypted if plain ws:// is used. Because agent messages often contain task context or sensitive data, omitting transport-security guidance materially increases the risk of accidental data exposure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This markdown test report uses Chinese throughout headings, labels, and status text, which effectively forces a specific language for users reading or maintaining the skill documentation. The policy allows locale constraints only when the skill offers user choice or clearly documents a justified region-specific scope, neither of which appears here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This script sends a user-supplied message to multiple agents with no confirmation, warning, or visibility control, which creates a real data-transmission risk. If the message contains sensitive prompts, credentials, or internal context, the operator may unintentionally disclose that data to a broader set of recipients than intended.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The module docstring says this is a 'WebSocket message broker server' and 'Agent communication core', which implies transient message brokering over WebSockets. However, the implementation writes per-agent status files and stores message payloads under the data directory, adding file-based persistence behavior not reflected in the documentation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The module description and user-visible runtime strings are written only in Chinese, with no indication that language can be selected by the user. This can violate language/locale policy when a skill implicitly forces one language without opt-in or documented regional scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

Message contents from connected agents are written to local JSON files without any access control, retention policy, encryption, or user disclosure visible in this component. In an agent system, messages may contain credentials, prompts, internal data, or sensitive operational content, so silent persistence increases confidentiality risk if the host or data directory is accessed by unauthorized parties.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The code sends sender ID, recipient ID, and message content over a WebSocket connection, but there is no confirmation prompt or user-facing notice at the point of transmission. Although the function docstrings describe the mechanism, they do not disclose to the user that provided message data will be transmitted over the local WebSocket service.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The module docstring describes the script as an "Agent状态查询工具" and only shows a query-style usage example with --agent, implying read-only status retrieval. However, the code also exposes --update and update_agent_status(), which create directories and write JSON status files to disk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This code file contains natural-language strings such as the module docstring and CLI description entirely in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This is a code file, so natural-language policy checks apply to docstrings and printed strings. The script presents its interface and descriptions only in Chinese, with no opt-in, alternative language, or stated regional justification, which can violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/test_skill.py (reported line 17)May include surrounding context.

python
def run_command(cmd: list) -> dict:
    """运行命令并返回结果"""
    try:
        result = subprocess.run(
            ["python3"] + cmd,
            capture_output=True,
            text=True,

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

User-facing docstrings, help text, and status/error messages are written exclusively in Chinese, which imposes a specific language on users without opt-in. The policy allows locale constraints only when justified or when the user is offered a choice, neither of which appears in this file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This code sends user-supplied message content and routing data to a remote WebSocket server, but there is no confirmation prompt and no explicit user disclosure beyond a generic 'send message' label. For a code file, network transmission of user data should have some visible warning unless the disclosure is already clearly documented; that is not present in this file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The broadcast path transmits a message and recipient list over the network to multiple agents, which can affect privacy and data exposure, yet the code provides no disclosure about that broader transmission scope. The CLI only describes the argument format and does not warn users that their content will be distributed to several recipients via the server.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The top-level documentation presents the tool's usage as limited to write, read, and list operations. However, the implementation and CLI parser also expose a destructive --delete action, which changes the skill's intent from simple shared-data access to modification and removal of stored data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This code deletes workspace data via unlink() when --delete is used, but there is no confirmation prompt, warning message, or explanatory comment/docstring indicating the action's destructive nature. For a code file, destructive or irreversible operations should have some visible user disclosure unless clearly covered elsewhere.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The natural-language instructions and descriptions are presented exclusively in Chinese, with no indication of language choice or opt-in. This can violate language/locale policy when users are not given an alternative or an explicit region-specific justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

SQP-3 applies to all file types and includes language or locale policy violations. The natural-language docstrings and CLI descriptions are presented only in Chinese, with no indication of user choice or opt-in for language, which can be interpreted as forcing a specific language.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The broker writes per-agent online/offline status to disk without notice and without visible controls around access, retention, or consent. While less sensitive than full message bodies, status logs can still reveal presence, activity timing, and system topology, which may aid reconnaissance or privacy-invasive monitoring.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

Natural-language strings in the module docstring, comments, argument descriptions, and CLI description are presented only in Chinese. This imposes a language choice on users without opt-in or documentation that the skill is intentionally limited to a Chinese-speaking context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The natural-language strings in the module docstring and argument help are entirely in Chinese, with no indication that the tool is region-specific or that users can select another language. This can violate language/locale policy when a skill forces a specific language without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.