Security audit

agent-link-relay-server

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to provide a legitimate agent relay, but its documented setup allows sensitive agent messages to travel over plaintext WebSockets and under-explains the trust boundary.

Review this carefully before installing. Use it only on trusted infrastructure, prefer WSS/TLS for any non-local connection, rotate shared secrets, avoid sending confidential prompts or credentials through the relay, and do not rely on the public_key field unless the implementation actually verifies signatures or encrypts traffic.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The code claims to provide secure communication, but it starts a plain WebSocket server on 0.0.0.0 and forwards message contents in cleartext at the application layer. Without TLS and without end-to-end encryption, any network observer or intermediary can read or tamper with traffic, which is especially risky for an agent-to-agent relay handling potentially sensitive prompts, outputs, or control messages.

Intent-Code Divergence

Low

Confidence: 92% confidence
Finding: The server stores a public_key during registration, suggesting an asymmetric trust model, but never uses it for authentication, signature verification, or encryption. This creates a misleading security posture and leaves the system dependent on a shared secret HMAC scheme, increasing the blast radius if that secret is exposed and making instance identity assurance much weaker than implied.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README provides a configuration example using plain `ws://` for a cross-device relay and only says WSS is 'recommended', which can lead operators to deploy the system without transport encryption. In that case, message contents and metadata are exposed in transit, and because the design uses a shared secret across the relay and agents, traffic interception can materially weaken trust in the whole system even if HMAC protects against simple tampering.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill instructs users to route agent messages, identifiers, and shared secrets through a relay architecture, but it does not present a prominent warning about the trust boundary, metadata exposure, and risks of operating through another machine. This can lead users to unknowingly transmit sensitive agent communications over infrastructure they may not fully control, increasing the risk of interception, logging, misconfiguration, or unauthorized relay access—especially since examples also show insecure ws:// URLs and shared-secret configuration.

Static analysis

No suspicious patterns detected.