Agent Zero Bridge

• Outcome: Review
• Latest audit: Jul 10, 2026 · 2:16 AM UTC
• Version: 1.0.0

Overview

The skill is a real Agent Zero bridge, but it exposes broad Clawdbot control and file-sharing paths with weak scoping and safety warnings.

Install only if you intentionally want Agent Zero to operate as a powerful peer to Clawdbot. Prefer localhost or a private Docker network instead of exposing the gateway on all interfaces, use a dedicated low-privilege token if possible, review every file passed with --attach, avoid sending secrets or regulated data, and reset context between unrelated tasks.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill clearly instructs users to configure environment-based secrets and make outbound network connections, yet it declares no permissions. This undermines least-privilege review and can cause operators to install or trust a skill without understanding that it handles API tokens and network-reachable services.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The setup tells users to bind the Clawdbot gateway to 0.0.0.0, exposing it on all network interfaces, but does not prominently warn that this makes the service remotely reachable. Even with token auth enabled, broader exposure increases the attack surface for token theft, brute force, misconfiguration, or accidental access from untrusted networks; in this skill's context, the gateway can trigger delegated coding and tool actions, making compromise more consequential.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The client reads arbitrary local files from paths supplied in options.attach, base64-encodes them, and sends their contents to a remote API. In a delegation skill like this, that creates a real data exfiltration risk if higher-level code passes sensitive files without explicit user confirmation or clear disclosure.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The sendMessage method transmits user message content, optional context_id, and potentially prior conversation state to a remote service, while this library itself provides no user-facing notice or consent mechanism. Because the skill is specifically designed to delegate autonomous coding/research tasks to an external framework, the chance of unintentionally sending sensitive prompts, code, or project context is materially higher.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/lib/clawdbot_api.js:10

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/lib/clawdbot_api.js:12