ClawHub
Back to skill

Security audit

AgentLink Protocol

Security checks for vulnerabilities and agentic risk

Overview

The skill is a P2P agent communication guide, but it also exposes broad file, web, and scheduling intents and asks users to run mutable remote packages without version or integrity controls.

Review this skill before installing. Use pinned, verified package versions, avoid the mutable curl install path unless you verify the file yourself, start new contacts at ask, and do not enable file, web, or scheduling intents for remote agents unless you have explicit path, destination, and approval limits in place.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:27
Finding

Unpinned Third-Party Package Installation and Execution

Content
View full analysis
Remediation
View remediation
``` 2. Commit an npm lockfile containing registry URLs and integrity hashes. 3. Replace unversioned `npx` use with an explicitly pinned package invocation, for example: ```bash npm exec --package=@agentlink/cli@ -- agentlink init --name "My Assistant" ``` 4. Install dependencies with lockfile enforcement, such as `npm ci`, in supported project workflows. 5. Verify the publisher, package ownership, provenance attestations, signatures, and integrity metadata before installation. 6. Explain and validate why the installed library and executed CLI use different npm scopes. 7. Disable lifecycle scripts where they are unnecessary and operationally compatible, or review all lifecycle scripts before installation. 8. Run the software under a dedicated, least-privileged account or sandbox without unnecessary credentials or filesystem access. 9. Include the audited dependency manifests and lockfile in the project so reviewers can assess the actual dependency graph. ]]>

T03 · Remote Payload Retrieval and Execution

Warning
Location
SKILL.md:37
Finding

Mutable Remote Skill Retrieval Without Integrity Verification

Content
View full analysis
Remediation
View remediation
' echo ' skills/agentlink/SKILL.md' | sha256sum --check - ``` 3. Sign release artifacts and verify signatures against a documented, trusted maintainer key. 4. Require users to inspect or diff downloaded Skill instructions before registering them with OpenClaw. 5. Bundle the reviewed Skill in a versioned package rather than retrieving it independently from a mutable branch. 6. Apply least privilege when loading the Skill: grant only required tools, restrict filesystem paths and network destinations, and require confirmation for sensitive operations. 7. Document a controlled update process that repeats security review and integrity verification whenever the pinned Skill version changes. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (14)

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md
### 1. agentlink/

**File:** `skills/agentlink/SKILL.md`

**Purpose:** Teaches OpenClaw agents to communicate via P2P using the AgentLink protocol.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md
### 1. agentlink/

**File:** `skills/agentlink/SKILL.md`

**Purpose:** Teaches OpenClaw agents to communicate via P2P using the AgentLink protocol.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md
### 1. agentlink/

**File:** `skills/agentlink/SKILL.md`

**Purpose:** Teaches OpenClaw agents to communicate via P2P using the AgentLink protocol.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md
### 1. agentlink/

**File:** `skills/agentlink/SKILL.md`

**Purpose:** Teaches OpenClaw agents to communicate via P2P using the AgentLink protocol.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 204)May include surrounding context.

md
### 1. agentlink/

**File:** `skills/agentlink/SKILL.md`

**Purpose:** Teaches OpenClaw agents to communicate via P2P using the AgentLink protocol.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 207)May include surrounding context.

md
### 1. agentlink/

**File:** `skills/agentlink/SKILL.md`

**Purpose:** Teaches OpenClaw agents to communicate via P2P using the AgentLink protocol.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.

md
### 1. agentlink/

**File:** `skills/agentlink/SKILL.md`

**Purpose:** Teaches OpenClaw agents to communicate via P2P using the AgentLink protocol.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill is presented as teaching P2P communication, but later documents broader capabilities including file, web, and scheduling intents. This mismatch can mislead operators about the scope of authority they are granting, increasing the risk of over-permissioned deployment and unsafe trust decisions. In a skill file, scope ambiguity is security-relevant because users rely on the description to judge risk.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The skill instructs users to run npx @agentlink/cli without pinning a specific package version. That allows whatever version is current in the registry at execution time to be fetched and run, creating supply-chain risk if a compromised or incompatible release is published. In a skill context, this is more dangerous because users are being told to execute remote package code directly as part of setup/operation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The command npx @agentlink/cli start is unpinned and will execute the latest registry version at runtime. This exposes users to unexpected code changes or malicious package updates, which is especially risky because the tool is started as part of an agent communications stack and may gain access to local/network resources.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The listed intents include actions that affect local data and external communications, but the documentation does not provide concrete warnings about privacy, system integrity, or abuse scenarios for those operations. Users may therefore enable or trust the skill without understanding that it could read files, write files, or fetch/search remote content on behalf of other agents.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill introduces files.read, files.write, web.fetch, and web.search intents even though its stated purpose is P2P messaging. Those capabilities materially expand the attack surface from messaging into local data access and outbound network activity, enabling data exfiltration, file tampering, or SSRF-like behavior if exposed to remote agents. The context makes this more dangerous because trust decisions may be made under the assumption the skill is only for communication.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 207)May include surrounding context.

ls -la skills/agentlink/SKILL.md

Check permissions

chmod 644 skills/agentlink/SKILL.md

text

### Tools not available

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The troubleshooting step again recommends npx @agentlink/cli start without version pinning. Repeating the pattern in troubleshooting increases the chance users will run arbitrary latest-version code during incident handling, when they may be less cautious.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.