Agent Zero Bridge

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:46 AM UTC
• Version: 1.0.0

Overview

The skill is a real Agent Zero bridge, but it gives an autonomous container broad Clawdbot access and persistent credentials with weak scoping.

Install only if you are comfortable granting Agent Zero broad access through your Clawdbot gateway. Use a dedicated least-privilege token, avoid binding the gateway to public or LAN interfaces unless protected, do not copy broad .env files into the container, restrict which tools Agent Zero can invoke, and review every attachment path before sending files.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/lib/clawdbot_api.js:75
• Finding: Unrestricted Clawdbot Tool Invocation Through the Main Session<![CDATA[ ## Vulnerability Details **File Location**: `scripts/lib/clawdbot_api.js:75-83`; exposed by `scripts/clawdbot_client.js:78-85` **Vulnerability Type**: Missing authorization boundaries for delegated tool invocation **Risk Level**: Critical ### Vulnerable Code ```javascript // scripts/lib/clawdbot_api.js:75-83 async invokeTool(tool, args = {}, sessionKey = "main") { const payload = { tool, args, sessionKey }; const data = await this.request('/tools/invoke', 'POST', payload); return data.result || data; } ``` ```javascript // scripts/clawdbot_client.js:78-85 case 'tool': const toolName = parsed.args[0]; if (!toolName) { console.error("Error: Provide tool name"); process.exit(1); } const toolArgs = parsed.args[1] ? JSON.parse(parsed.args[1]) : {}; result = await client.invokeTool(toolName, toolArgs); result = JSON.stringify(result, null, 2); break; ``` ### Technical Analysis The bridge accepts an arbitrary tool name and arbitrary JSON arguments from the command line and forwards them directly to Clawdbot's `/tools/invoke` endpoint. No local allowlist, argument schema validation, per-tool authorization, user confirmation, or policy enforcement is applied. `invokeTool` also defaults to the privileged `main` session. Consequently, Agent Zero receives a generic capability proxy rather than only the narrowly defined progress-reporting and question-answering capabilities needed by the Skill. The ultimate operations available depend on the tools enabled by the Clawdbot gateway and the permissions associated with the bearer token. However, the bridge itself imposes no restriction on those operations. ### Attack Path 1. An attacker compromises Agent Zero, influences an autonomous task, or causes it to execute a crafted bridge command. 2. Agent Zero runs: ```bash node /a0/bridge/clawdbot_client.js tool <enabled-tool-name> '<attacker-controlled-json>' ``` 3. `clawdb ...[truncated 795 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the generic `tool <name> <json>` forwarding interface. 2. Define a strict allowlist containing only the minimum required operations, such as a dedicated notification endpoint. 3. Validate every tool argument against a fixed schema and reject unknown properties. 4. Use a dedicated Agent Zero session rather than the `main` session. 5. Issue a separate, least-privilege gateway token that cannot invoke unrelated tools. 6. Require explicit user approval before invoking tools that access files, execute commands, alter state, or communicate externally. 7. Enforce authorization at the gateway endpoint; client-side restrictions must not be the only control. 8. Record auditable logs containing the requesting identity, selected tool, session, authorization decision, and result. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:60
• Finding: Gateway Bearer Token and Delegated Data Sent Over Plaintext HTTP<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:60-69`; `scripts/lib/config.js:37-40`; `scripts/lib/clawdbot_api.js:24-39` **Vulnerability Type**: Plaintext transmission of authentication credentials and delegated content **Risk Level**: High ### Vulnerable Configuration and Code ```json // SKILL.md:60-69 { "gateway": { "bind": "0.0.0.0", "auth": { "mode": "token", "token": "your_token" }, "http": { "endpoints": { "chatCompletions": { "enabled": true } } } } } ``` ```javascript // scripts/lib/config.js:37-40 clawdbot: { apiUrl: process.env.CLAWDBOT_API_URL || "http://127.0.0.1:18789", apiUrlDocker: process.env.CLAWDBOT_API_URL_DOCKER || process.env.CLAWDBOT_API_URL || "http://127.0.0.1:18789", apiToken: process.env.CLAWDBOT_API_TOKEN || "", defaultTimeout: parseInt(process.env.CLAWDBOT_TIMEOUT) || 60000 }, ``` ```javascript // scripts/lib/clawdbot_api.js:24-39 try { const options = { method, headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${this.apiToken}` }, signal: controller.signal }; if (body) { options.body = JSON.stringify(body); } const response = await fetch(`${this.apiUrl}${endpoint}`, options); ``` ### Technical Analysis The installation instructions direct users to bind the gateway to `0.0.0.0`, making it reachable through available host network interfaces. The documented Docker URL uses an unencrypted LAN endpoint such as `http://192.168.1.x:18789`. Every request includes the gateway bearer token in the `Authorization` header. Message content, tool arguments, responses, and the bearer token can therefore traverse the network without transport encryption. The code accepts arbitrary configured URLs and does not reject non-HTTPS remote destinations. Plaintext loopback HTTP may be acceptable for strictly local communication, but binding to all interfaces and using a LAN address changes the t ...[truncated 1303 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not bind the gateway to `0.0.0.0` by default. Prefer loopback, a Unix socket, or an isolated container network. 2. Require TLS for every non-loopback connection and reject remote `http://` URLs. 3. Validate configured URLs against an explicit host and protocol allowlist. 4. Restrict gateway access with host firewall rules and container-network policies. 5. Use scoped, short-lived tokens dedicated to this bridge rather than a general gateway token. 6. Add token rotation and immediate revocation procedures. 7. Consider mutual TLS or workload identity for container-to-host authentication. 8. Clearly warn users that plaintext LAN transport exposes credentials and delegated content. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:74
• Finding: Complete Credential File Copied Into the Autonomous Agent Zero Container<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:74-78`; credentials are loaded by `scripts/lib/config.js:8-18` **Vulnerability Type**: Excessive credential exposure across a container trust boundary **Risk Level**: High ### Vulnerable Instructions and Code ```bash # SKILL.md:74-78 docker exec <container> mkdir -p /a0/bridge/lib docker cp scripts/lib/. <container>:/a0/bridge/lib/ docker cp scripts/clawdbot_client.js <container>:/a0/bridge/ docker cp .env <container>:/a0/bridge/ docker exec <container> sh -c 'echo "DOCKER_CONTAINER=true" >> /a0/bridge/.env' ``` ```javascript // scripts/lib/config.js:8-18 try { const fs = require('fs'); const envPath = path.join(__dirname, '..', '.env'); if (fs.existsSync(envPath)) { const envContent = fs.readFileSync(envPath, 'utf8'); envContent.split('\n').forEach(line => { const match = line.match(/^\s*([\w.-]+)\s*=\s*(.*)?\s*$/); if (match && !process.env[match[1]]) { process.env[match[1]] = match[2] || ''; } }); } ``` ### Technical Analysis The setup copies the entire `.env` file into `/a0/bridge/.env` inside Agent Zero's container. Based on the documented configuration, that file contains both `A0_API_KEY` and `CLAWDBOT_API_TOKEN`. Agent Zero is intended to perform autonomous coding and research tasks, potentially executing generated code and interacting with untrusted content. Placing a reusable gateway credential in a readable file inside that environment unnecessarily expands the credential's exposure. The instructions do not specify restrictive ownership or permissions, a read-only secret mount, a dedicated scoped token, expiration, or automatic credential rotation. ### Attack Path 1. The user follows the setup and copies `.env` into the Agent Zero container. 2. An attacker-controlled task, compromised dependency, or process running with sufficient container permissions reads `/a0/bridge/.env`. 3. The proce ...[truncated 748 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Never copy the complete host `.env` file into the Agent Zero container. 2. Create a dedicated bridge credential with only the minimum required permissions. 3. Supply secrets through a container secrets mechanism or a read-only file mounted only for the bridge process. 4. Apply restrictive ownership and permissions, such as mode `0600`, where file-based secrets are unavoidable. 5. Separate Agent Zero credentials from Clawdbot gateway credentials. 6. Use short-lived credentials and rotate them after container recreation or suspected compromise. 7. Prevent arbitrary Agent Zero workloads from reading the bridge secret through process isolation or a separate sidecar service. 8. Document credential revocation and incident-response procedures. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/lib/a0_api.js:87
• Finding: Unrestricted Local File Attachment Transmission to a Configurable Endpoint<![CDATA[ ## Vulnerability Details **File Location**: `scripts/lib/a0_api.js:87-108` **Vulnerability Type**: Insufficient validation of files transmitted to an external API **Risk Level**: Medium ### Vulnerable Code ```javascript const attachments = []; if (options.attach) { const files = Array.isArray(options.attach) ? options.attach : [options.attach]; for (const filePath of files) { try { const content = fs.readFileSync(filePath); attachments.push({ filename: path.basename(filePath), base64: content.toString('base64') }); } catch (err) { console.warn(`Warning: Could not read attachment ${filePath}`); } } } const payload = { message, context_id: contextId || undefined, attachments: attachments.length > 0 ? attachments : undefined, lifetime_hours: this.lifetimeHours }; const data = await this.request('/api_message', 'POST', payload, options.timeout); ``` ### Technical Analysis Attachment transmission is declared functionality, and files are only attached when a path is supplied. However, the implementation accepts any path readable by the running process. It does not enforce a workspace boundary, resolve and verify canonical paths, reject symbolic-link escapes, block likely secret files, impose a size limit, or request confirmation before transmission. The selected file is read completely into memory, encoded as base64, and sent to the configured `A0_API_URL`. Base64 is transport encoding and provides no confidentiality. Because the destination is configurable and remote HTTP is not prohibited, an incorrect or attacker-influenced destination can receive the complete file. ### Attack Path 1. An attacker influences the arguments used to invoke `a0_client.js`, or a user mistakenly selects a sensitive path. 2. The bridge is invoked with an option such as: ```bash node scripts/a0_client.js message "Review this file" --att ...[truncated 782 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Restrict attachments to explicitly configured workspace roots. 2. Resolve each path with `realpath` and verify that the canonical path remains within an allowed root. 3. Reject symbolic links or verify their resolved targets. 4. Block sensitive filenames and locations, including `.env`, private keys, credential stores, and token files. 5. Require explicit user confirmation showing the canonical path, file size, and destination before upload. 6. Enforce conservative per-file and total-request size limits. 7. Require HTTPS for remote Agent Zero endpoints and validate destinations against an allowlist. 8. Stream permitted files rather than synchronously loading and base64-encoding the entire file. 9. Clearly disclose that attachments leave the local process and may be retained by Agent Zero. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (32)

Credential Access

High

• Category: Privilege Escalation

Content

# Configure
cd ~/.clawdbot/skills/agent-zero-bridge
cp .env.example .env
# Edit .env with your API keys (see SKILL.md for details)
```

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: If the implementation only offers simple request/response, local file creation, and tool invocation, then marketing it as long-running autonomous delegation with attachments and progress reporting is misleading. In a bridge skill, this matters because operators may approve elevated access based on inaccurate assumptions about the trust model and execution flow.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: If the implementation only offers simple request/response, local file creation, and tool invocation, then marketing it as long-running autonomous delegation with attachments and progress reporting is misleading. In a bridge skill, this matters because operators may approve elevated access based on inaccurate assumptions about the trust model and execution flow.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: If the implementation only offers simple request/response, local file creation, and tool invocation, then marketing it as long-running autonomous delegation with attachments and progress reporting is misleading. In a bridge skill, this matters because operators may approve elevated access based on inaccurate assumptions about the trust model and execution flow.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: If the implementation only offers simple request/response, local file creation, and tool invocation, then marketing it as long-running autonomous delegation with attachments and progress reporting is misleading. In a bridge skill, this matters because operators may approve elevated access based on inaccurate assumptions about the trust model and execution flow.

Credential Access

High

• Category: Privilege Escalation

Content

cp .env.example .env
```

### 3. Configure .env
```env
# Agent Zero (get token from A0 settings or calculate from runtime ID)
A0_API_URL=http://127.0.0.1:50001

• Confidence: 83% confidence
• Finding: The configuration block instructs users to place active API tokens in a plaintext .env file for both Agent Zero and the Clawdbot gateway. Storing bridge credentials in a local file increases the chance of accidental disclosure through backups, logs, filesystem compromise, or later copying into less trusted environments.

Credential Access

High

• Category: Privilege Escalation

Content

```python
# Calculate from A0's runtime ID
import hashlib, base64
runtime_id = "your_A0_PERSISTENT_RUNTIME_ID"  # from A0's .env
hash_bytes = hashlib.sha256(f"{runtime_id}::".encode()).digest()
token = base64.urlsafe_b64encode(hash_bytes).decode().replace("=", "")[:16]
print(token)

• Confidence: 81% confidence
• Finding: The instructions derive an Agent Zero token from a persistent runtime ID stored in .env, effectively turning a long-lived identifier into an access credential. If the runtime ID is disclosed, an attacker may be able to recreate the token, so the runtime ID must be treated as sensitive secret material.

Credential Access

High

• Category: Privilege Escalation

Content

docker exec <container> mkdir -p /a0/bridge/lib
docker cp scripts/lib/. <container>:/a0/bridge/lib/
docker cp scripts/clawdbot_client.js <container>:/a0/bridge/
docker cp .env <container>:/a0/bridge/
docker exec <container> sh -c 'echo "DOCKER_CONTAINER=true" >> /a0/bridge/.env'
```

• Confidence: 96% confidence
• Finding: Copying the host .env into the Agent Zero container transfers API credentials into a separate trust boundary that may be less hardened or may run untrusted workloads. If the container is compromised, the attacker can harvest both Agent Zero and Clawdbot gateway tokens and pivot into external services.

Credential Access

High

• Category: Privilege Escalation

Content

docker cp scripts/lib/. <container>:/a0/bridge/lib/
docker cp scripts/clawdbot_client.js <container>:/a0/bridge/
docker cp .env <container>:/a0/bridge/
docker exec <container> sh -c 'echo "DOCKER_CONTAINER=true" >> /a0/bridge/.env'
```

## Usage

• Confidence: 94% confidence
• Finding: Appending to /a0/bridge/.env confirms the containerized environment persists and uses the copied credential file in place, increasing the likelihood that secrets remain resident and discoverable inside the container filesystem. Persistent plaintext secrets in containers are a common post-compromise prize and make lateral movement easier.

Ae1

High

• Category: analysis-evasion

Content

node scripts/a0_client.js "Build a REST API with JWT authentication"

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/a0_client.js "Build a REST API with JWT authentication"

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/a0_client.js "Build a REST API with JWT authentication"

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/a0_client.js "Build a REST API with JWT authentication"

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/a0_client.js "Build a REST API with JWT authentication"

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/a0_client.js "Build a REST API with JWT authentication"

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Memory Manipulation

High

• Category: Memory Poisoning

Content

```bash
node scripts/a0_client.js status
node scripts/a0_client.js history
node scripts/a0_client.js reset  # Clear conversation
```

### Task Breakdown (Creates Tracked Project)

• Confidence: 80% confidence
• Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Ae1

High

• Category: analysis-evasion

Content

node scripts/task_breakdown.js "Build e-commerce platform"

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Credential Access

High

• Category: Privilege Escalation

Content

/**
 * Shared Configuration
 * Reads from environment variables or .env file
 */

const path = require('path');

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

/**
 * Shared Configuration
 * Reads from environment variables or .env file
 */

const path = require('path');

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

/**
 * Shared Configuration
 * Reads from environment variables or .env file
 */

const path = require('path');

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

/**
 * Shared Configuration
 * Reads from environment variables or .env file
 */

const path = require('path');

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

/**
 * Shared Configuration
 * Reads from environment variables or .env file
 */

const path = require('path');

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

/**
 * Shared Configuration
 * Reads from environment variables or .env file
 */

const path = require('path');

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

/**
 * Shared Configuration
 * Reads from environment variables or .env file
 */

const path = require('path');

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

// Load .env file if it exists
try {
    const fs = require('fs');
    const envPath = path.join(__dirname, '..', '.env');
    if (fs.existsSync(envPath)) {
        const envContent = fs.readFileSync(envPath, 'utf8');
        envContent.split('\n').forEach(line => {

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/lib/clawdbot_api.js:10

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/lib/clawdbot_api.js:12