Agent Zero Bridge

AdvisoryAudited by Static analysis on May 10, 2026.

Overview

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ConcernHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

If Agent Zero is compromised, misprompted, or given an unsafe task, it may be able to trigger any Clawdbot tool available to the gateway, not just report progress or ask questions.

Why it was flagged

The bridge exposes a generic tool-invocation API where the tool name and arguments are passed through to Clawdbot without an allowlist, confirmation gate, or visible restriction to safe tools.

Skill content

async invokeTool(tool, args = {}, sessionKey = "main") { ... const data = await this.request('/tools/invoke', 'POST', payload); }

Recommendation

Limit the gateway token to specific low-risk tools if possible, add an allowlist in the bridge client, and require user approval before Agent Zero can invoke tools that modify files, accounts, sessions, or external systems.

ConcernHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

The Agent Zero container receives credentials that can act through the Clawdbot gateway, which may exceed what users expect from a task-delegation bridge.

Why it was flagged

The setup copies the Clawdbot gateway token into the Agent Zero container, giving that autonomous environment delegated access to Clawdbot. The metadata declares no primary credential or required environment variables.

Skill content

CLAWDBOT_API_TOKEN=your_gateway_token ... docker cp .env <container>:/a0/bridge/

Recommendation

Use a separate least-privilege gateway token for this bridge, rotate it if exposed, avoid sharing a main/admin token with Agent Zero, and document the exact permissions granted.

ConcernHigh Confidence

ASI07: Insecure Inter-Agent Communication

What this means

Clawdbot may treat Agent Zero output as if it were a user request, which can blur responsibility and make prompt-injection or unsafe delegated instructions harder to contain.

Why it was flagged

Messages from Agent Zero are forwarded into Clawdbot as user-role chat messages, distinguished only by a text prefix, with no stronger origin, trust, or instruction-boundary handling shown.

Skill content

messages: [{ role: "user", content: options.prefix ? `${options.prefix}\n\n${message}` : message }]

Recommendation

Treat all Agent Zero messages as untrusted delegated-agent content, keep a visible prefix, add policy checks before acting on them, and avoid enabling automatic tool execution from these messages.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Users may need to rely on external setup material or recreate configuration manually, and provenance is less clear than it would be with a declared source and complete packaged template.

Why it was flagged

The README references an external GitHub source and an `.env.example` file, while registry metadata lists source as unknown/homepage none and the provided manifest does not include `.env.example`.

Skill content

git clone https://github.com/DOWingard/Clawdbot-Agent0-Bridge.git ... cp .env.example .env

Recommendation

Verify the repository and files before installing, and the publisher should declare the source URL and include the referenced `.env.example` template in the package.

NoteHigh Confidence

ASI10: Rogue Agents

What this means

Delegated work may continue for longer than a normal chat turn and may have its own environment and context.

Why it was flagged

The skill is explicitly designed to delegate long-running autonomous work to Agent Zero in a persistent Docker environment.

Skill content

Long-running builds, tests, or infrastructure work ... Tasks needing persistent Docker execution environment

Recommendation

Use it only for tasks you intend to delegate, monitor Agent Zero progress, and know how to stop/reset the Agent Zero container and bridge context.

Findings (2)

critical

suspicious.env_credential_access

Location: scripts/lib/clawdbot_api.js:10
Finding: Environment variable access combined with network send.

critical

suspicious.exposed_secret_literal

Location: scripts/lib/clawdbot_api.js:12
Finding: File appears to expose a hardcoded API secret or token.