Security audit

A2a Msg

Security checks for vulnerabilities and agentic risk

Overview

This Redis messaging skill is not clearly malicious, but it needs Review because its auto mode lets Redis messages trigger local actions and automatic replies without strong sender authentication or secure transport.

Install only if you trust and secure the Redis server, understand that auto mode can process queued messages as commands, and are willing to accept automatic replies and local skill-name disclosure. Avoid scheduling auto mode, avoid exposing Redis directly, prefer TLS or a private tunnel with ACLs, and do not use it with sensitive messages until sender authentication and per-command authorization are added.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T06 · System Persistence

Warning

Location: SKILL.md:132
Finding: Optional Scheduled Task Creates Persistent Unattended Message Processing
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/a2a.py:246
Finding: Redis Messages Are Treated as Authorized Commands Without Sender Authentication
Content: View full analysis
list: """Receive messages from the message queue.""" r = get_redis() queue_key = f"msgs_{CONFIG['my_id']}" messages = [] while True: msg = r.rpop(queue_key) if not msg: break try: data = json.loads(msg) messages.append(data) except: pass return messages ``` ```python def auto_process() -> str: """Automatically process queued messages.""" messages = receive_messages() if not messages: return "No new messages need processing" results = [] for msg in messages: sender = msg.get("from", "unknown") content = msg.get("content", "") print(f"Processing message from {sender}: {content}") result = process_message_with_ai(content) results.append(f"From {sender}: {content}\n→ {result}") if sender != CONFIG["my_id"]: send_message(sender, result) return "\n\n".join(results) if results else "Processing complete" ``` ### Technical Analysis A message consists only of attacker-controlled JSON fields such as `from` and `content`. The implementation does not verify a digital signature or message authentication code, enforce an approved-sender list, validate freshness, prevent replay, or authorize individual commands. Possession of Redis write access is therefore treated as sufficient authority to issue commands. The `from` value is also trusted when selecting the response queue, allowing a sender to impersonate another agent or direct output to an arbitrary queue name. The commands currently implemented are constrained and do not directly execute arbitrary shell input. Nevertheless, they can enumerate local skill names ...[truncated 1772 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/a2a.py:36
Finding: Redis Credentials and Messages May Be Transmitted Without TLS
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/a2a.py:174
Finding: Hard-Coded Personal Skills Path Can Disclose Local Capability and Filesystem Information
Content: View full analysis
str: """List installed skills.""" try: skills = os.listdir(SKILLS_DIR) skill_list = "\n".join([f"- {s}" for s in skills]) return f"My current skill list:\n{skill_list}" except Exception as e: return f"Failed to retrieve skill list: {e}" ``` ### Technical Analysis The source contains a developer-specific absolute path that reveals a local username and assumes a fixed Windows workspace layout. This creates both portability and information-disclosure concerns. When automatic processing receives a matching `show skills` command, the function returns directory entry names to the remote sender. If directory enumeration fails, the raw exception text is returned instead. Such exceptions may include the absolute local path and operating-system details. Because message senders are not authenticated at the application layer, any party with Redis write access can request this information. ### Attack Path 1. An attacker gains the ability to write to the configured Redis instance. 2. The attacker pushes a message such as `show skills` to the victim agent's queue. 3. The victim executes `auto_process()`. 4. Command matching selects `execute_list_skills()`. 5. The code enumerates the hard-coded local directory. 6. Directory names are returned to the attacker, or a raw exception reveals the local path and related environment details. ### Impact Assessment The issue can disclose: - A local Windows username embedded in the source. - Installed skill or capability names. - Workspace layout and operating-system path conventions. - Exception details useful for reconnaissance. The functi ...[truncated 211 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import

Findings (15)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared purpose is message passing over Redis, but the documented behavior includes automatically interpreting messages, listing local skills, executing local commands, and sending replies based on remote input. That mismatch hides a remote-action surface behind a benign description, which can lead users to enable a skill that effectively acts on untrusted messages.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The auto-processing trigger uses very vague commands like '自动处理' and 'auto' for a mode that interprets incoming messages and executes actions. Because the trigger lacks strong invocation constraints, the skill could be activated accidentally and then process attacker-controlled Redis messages as commands.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The auto mode description says AI will understand messages, execute corresponding operations, and automatically reply, but it does not clearly warn that untrusted remote messages can drive local actions. In this context, Redis acts as an external command channel, so lack of warning materially increases the chance that users enable behavior equivalent to remote instruction execution.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill is presented as Redis-based messaging, but it also auto-interprets inbound messages and performs local actions such as listing local skills, checking queues, and sending further messages. This creates a remote command surface over Redis, so anyone able to enqueue messages for this agent can trigger unintended local behaviors without user approval.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/a2a.py (reported line 19)May include surrounding context.
python
sys.stdout = io.TextIOWrapper(sys.stdout.buffer, encoding='utf-8') # 配置 - 从环境变量读取 # 设置方式（添加到 ~/.openclaw/.env 或系统环境变量）： # A2A_REDIS_HOST=Redis服务器地址 # A2A_REDIS_PORT=6379 # A2A_REDIS_PASSWORD=密码

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: auto_process consumes inbound Redis messages and immediately performs matched actions without confirmation, trust validation, or sender authentication. In this context, Redis becomes a remote trigger channel for local operations and automatic replies, enabling unauthorized actioning, information disclosure, and possible message-loop abuse.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill declares no explicit tool scope or permission boundaries despite requiring environment variables and documenting network, file access, and shell-based execution paths. This is dangerous because users and orchestrators cannot accurately assess or constrain what the skill may access, increasing the chance of unintended capability exposure.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The receive-message activation examples are broad phrases such as '查看消息' and 'poll', which may be triggered in normal conversation without clear user intent to invoke the skill. Overbroad triggers can cause unintended polling of external message queues and expose the agent to untrusted remote content unexpectedly.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill’s natural-language description and command interface are primarily Chinese-only, and the embedded help text assumes Chinese-language interaction without offering a language choice. This creates a locale/language policy concern because the file imposes a specific language experience without explicit user opt-in or justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The code pushes message content to Redis, which transmits user-provided data over the network or IPC boundary, but there is no explicit warning about this data transfer beyond an implementation docstring. For users invoking the send flow, the script does not disclose that message contents are being stored in and transmitted via Redis.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The message handler exposes local filesystem inventory by listing the skills directory in response to inbound text. This leaks environment details to remote peers and helps an attacker profile available capabilities for follow-on abuse.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The weather handler invokes subprocess.run, and this path is reachable from incoming message interpretation. Even though the subprocess currently only prints guidance text, process creation is a powerful local capability unrelated to the stated purpose of Redis-based instance communication.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/a2a.py (reported line 204)May include surrounding context.
python
"""执行查天气""" try: # 调用天气skill result = subprocess.run( ["python", "-c", "import urllib.request; print('请使用天气skill查询')"], capture_output=True, text=True, timeout=5 )

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: Most of the skill description and usage guidance are presented only in Chinese, with only partial English trigger examples. There is no explicit statement that users may choose their preferred language, so this may conflict with a policy requiring language or locale choice unless the locale restriction is documented and justified.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The module docstring claims the skill 'supports AI understanding and automatic command execution,' suggesting broader semantic interpretation. In practice, process_message_with_ai only performs deterministic regex matching against a small set of hardcoded patterns and dispatches fixed functions, which does not match the documented behavior. This is an intent-level documentation overstatement rather than a mere omitted detail.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.