Agent Zero Bridge

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:46 AM UTC
• Version: 1.0.0

Overview

The skill is a real Agent Zero bridge, but it gives an autonomous container broad Clawdbot access and persistent credentials with weak scoping.

Install only if you are comfortable granting Agent Zero broad access through your Clawdbot gateway. Use a dedicated least-privilege token, avoid binding the gateway to public or LAN interfaces unless protected, do not copy broad .env files into the container, restrict which tools Agent Zero can invoke, and review every attachment path before sending files.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/lib/clawdbot_api.js:75

Finding

Unrestricted Clawdbot Tool Invocation Through the Main Session

Content

View full analysis

'' ``` 3. `clawdb ...[truncated 795 chars]

Remediation

View remediation

` forwarding interface. 2. Define a strict allowlist containing only the minimum required operations, such as a dedicated notification endpoint. 3. Validate every tool argument against a fixed schema and reject unknown properties. 4. Use a dedicated Agent Zero session rather than the `main` session. 5. Issue a separate, least-privilege gateway token that cannot invoke unrelated tools. 6. Require explicit user approval before invoking tools that access files, execute commands, alter state, or communicate externally. 7. Enforce authorization at the gateway endpoint; client-side restrictions must not be the only control. 8. Record auditable logs containing the requesting identity, selected tool, session, authorization decision, and result. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:60

Finding

Gateway Bearer Token and Delegated Data Sent Over Plaintext HTTP

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:74

Finding

Complete Credential File Copied Into the Autonomous Agent Zero Container

Content

View full analysis

mkdir -p /a0/bridge/lib docker cp scripts/lib/. :/a0/bridge/lib/ docker cp scripts/clawdbot_client.js :/a0/bridge/ docker cp .env :/a0/bridge/ docker exec sh -c 'echo "DOCKER_CONTAINER=true" >> /a0/bridge/.env' ``` ```javascript // scripts/lib/config.js:8-18 try { const fs = require('fs'); const envPath = path.join(__dirname, '..', '.env'); if (fs.existsSync(envPath)) { const envContent = fs.readFileSync(envPath, 'utf8'); envContent.split('\n').forEach(line => { const match = line.match(/^\s*([\w.-]+)\s*=\s*(.*)?\s*$/); if (match && !process.env[match[1]]) { process.env[match[1]] = match[2] || ''; } }); } ``` ### Technical Analysis The setup copies the entire `.env` file into `/a0/bridge/.env` inside Agent Zero's container. Based on the documented configuration, that file contains both `A0_API_KEY` and `CLAWDBOT_API_TOKEN`. Agent Zero is intended to perform autonomous coding and research tasks, potentially executing generated code and interacting with untrusted content. Placing a reusable gateway credential in a readable file inside that environment unnecessarily expands the credential's exposure. The instructions do not specify restrictive ownership or permissions, a read-only secret mount, a dedicated scoped token, expiration, or automatic credential rotation. ### Attack Path 1. The user follows the setup and copies `.env` into the Agent Zero container. 2. An attacker-controlled task, compromised dependency, or process running with sufficient container permissions reads `/a0/bridge/.env`. 3. The proce ...[truncated 748 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/lib/a0_api.js:87

Finding

Unrestricted Local File Attachment Transmission to a Configurable Endpoint

Content

View full analysis

0 ? attachments : undefined, lifetime_hours: this.lifetimeHours }; const data = await this.request('/api_message', 'POST', payload, options.timeout); ``` ### Technical Analysis Attachment transmission is declared functionality, and files are only attached when a path is supplied. However, the implementation accepts any path readable by the running process. It does not enforce a workspace boundary, resolve and verify canonical paths, reject symbolic-link escapes, block likely secret files, impose a size limit, or request confirmation before transmission. The selected file is read completely into memory, encoded as base64, and sent to the configured `A0_API_URL`. Base64 is transport encoding and provides no confidentiality. Because the destination is configurable and remote HTTP is not prohibited, an incorrect or attacker-influenced destination can receive the complete file. ### Attack Path 1. An attacker influences the arguments used to invoke `a0_client.js`, or a user mistakenly selects a sensitive path. 2. The bridge is invoked with an option such as: ```bash node scripts/a0_client.js message "Review this file" --att ...[truncated 782 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (32)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 39)May include surrounding context.

Configure

cd ~/.clawdbot/skills/agent-zero-bridge cp .env.example .env

Edit .env with your API keys (see SKILL.md for details)

text

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

If the implementation only offers simple request/response, local file creation, and tool invocation, then marketing it as long-running autonomous delegation with attachments and progress reporting is misleading. In a bridge skill, this matters because operators may approve elevated access based on inaccurate assumptions about the trust model and execution flow.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

If the implementation only offers simple request/response, local file creation, and tool invocation, then marketing it as long-running autonomous delegation with attachments and progress reporting is misleading. In a bridge skill, this matters because operators may approve elevated access based on inaccurate assumptions about the trust model and execution flow.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the implementation only offers simple request/response, local file creation, and tool invocation, then marketing it as long-running autonomous delegation with attachments and progress reporting is misleading. In a bridge skill, this matters because operators may approve elevated access based on inaccurate assumptions about the trust model and execution flow.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

If the implementation only offers simple request/response, local file creation, and tool invocation, then marketing it as long-running autonomous delegation with attachments and progress reporting is misleading. In a bridge skill, this matters because operators may approve elevated access based on inaccurate assumptions about the trust model and execution flow.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 83% confidence

Finding

The configuration block instructs users to place active API tokens in a plaintext .env file for both Agent Zero and the Clawdbot gateway. Storing bridge credentials in a local file increases the chance of accidental disclosure through backups, logs, filesystem compromise, or later copying into less trusted environments.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

cp .env.example .env

text

### 3. Configure .env
```env
# Agent Zero (get token from A0 settings or calculate from runtime ID)
A0_API_URL=http://127.0.0.1:50001

Credential Access

High

• Category: Privilege Escalation
• Confidence: 81% confidence

Finding

The instructions derive an Agent Zero token from a persistent runtime ID stored in .env, effectively turning a long-lived identifier into an access credential. If the runtime ID is disclosed, an attacker may be able to recreate the token, so the runtime ID must be treated as sensitive secret material.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

python

# Calculate from A0's runtime ID
import hashlib, base64
runtime_id = "your_A0_PERSISTENT_RUNTIME_ID"  # from A0's .env
hash_bytes = hashlib.sha256(f"{runtime_id}::".encode()).digest()
token = base64.urlsafe_b64encode(hash_bytes).decode().replace("=", "")[:16]
print(token)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

Copying the host .env into the Agent Zero container transfers API credentials into a separate trust boundary that may be less hardened or may run untrusted workloads. If the container is compromised, the attacker can harvest both Agent Zero and Clawdbot gateway tokens and pivot into external services.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

docker exec mkdir -p /a0/bridge/lib docker cp scripts/lib/. :/a0/bridge/lib/ docker cp scripts/clawdbot_client.js :/a0/bridge/ docker cp .env :/a0/bridge/ docker exec sh -c 'echo "DOCKER_CONTAINER=true" >> /a0/bridge/.env'

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

Appending to /a0/bridge/.env confirms the containerized environment persists and uses the copied credential file in place, increasing the likelihood that secrets remain resident and discoverable inside the container filesystem. Persistent plaintext secrets in containers are a common post-compromise prize and make lateral movement easier.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

docker cp scripts/lib/. :/a0/bridge/lib/ docker cp scripts/clawdbot_client.js :/a0/bridge/ docker cp .env :/a0/bridge/ docker exec sh -c 'echo "DOCKER_CONTAINER=true" >> /a0/bridge/.env'

text

## Usage

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

md

node scripts/a0_client.js "Build a REST API with JWT authentication"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

md

node scripts/a0_client.js "Build a REST API with JWT authentication"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

md

node scripts/a0_client.js "Build a REST API with JWT authentication"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md

node scripts/a0_client.js "Build a REST API with JWT authentication"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

md

node scripts/a0_client.js "Build a REST API with JWT authentication"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

md

node scripts/a0_client.js "Build a REST API with JWT authentication"

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

bash

node scripts/a0_client.js status
node scripts/a0_client.js history
node scripts/a0_client.js reset  # Clear conversation

Task Breakdown (Creates Tracked Project)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

md

node scripts/task_breakdown.js "Build e-commerce platform"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 40)May include surrounding context.

md

/**
 * Shared Configuration
 * Reads from environment variables or .env file
 */

const path = require('path');

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md

/**
 * Shared Configuration
 * Reads from environment variables or .env file
 */

const path = require('path');

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/lib/a0_api.js (reported line 18)May include surrounding context.

js

/**
 * Shared Configuration
 * Reads from environment variables or .env file
 */

const path = require('path');

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/lib/clawdbot_api.js (reported line 16)May include surrounding context.

js

/**
 * Shared Configuration
 * Reads from environment variables or .env file
 */

const path = require('path');

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/lib/config.js (reported line 3)May include surrounding context.

js

/**
 * Shared Configuration
 * Reads from environment variables or .env file
 */

const path = require('path');

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/lib/config.js (reported line 8)May include surrounding context.

js

/**
 * Shared Configuration
 * Reads from environment variables or .env file
 */

const path = require('path');

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/lib/config.js (reported line 22)May include surrounding context.

js

/**
 * Shared Configuration
 * Reads from environment variables or .env file
 */

const path = require('path');

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/lib/config.js (reported line 11)May include surrounding context.

js

// Load .env file if it exists
try {
    const fs = require('fs');
    const envPath = path.join(__dirname, '..', '.env');
    if (fs.existsSync(envPath)) {
        const envContent = fs.readFileSync(envPath, 'utf8');
        envContent.split('\n').forEach(line => {

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/lib/clawdbot_api.js:10

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/lib/clawdbot_api.js:12