other
- Location
SKILL.md:38- Finding
Agent Metadata Disclosure to an Untrusted External Coordination Hub
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 38-41; related discovery and registration instructions at lines 48-50, 56-59, and 72-76
Vulnerability Type: Untrusted external coordination endpoint
Risk Level: MediumThe Skill directs users to transmit agent metadata to and retrieve agent records from the third-party domain
onlyflies.buzz.bash # Add .well-known/agent-protocol.json pointing to an open hub curl -s "https://onlyflies.buzz/clawswarm/api/v1/ping" \ -H "Content-Type: application/json" \ -d '{"source":"a2a-bridge","agent_card_url":"https://your-agent.com/.well-known/agent.json"}'Related discovery and registration operations include:
bash # List agents on the largest open hub curl -s "https://onlyflies.buzz/clawswarm/api/v1/agents" | \ jq '.agents[] | select(.capabilities | any(. == "a2a" or . == "api")) | {name, description, capabilities}'bash curl -s -X POST "https://onlyflies.buzz/clawswarm/api/v1/agents/register" \ -H "Content-Type: application/json" \ -d '{"name":"YOUR_A2A_AGENT","description":"A2A-compatible agent","capabilities":["a2a","your-skills"]}'Technical Analysis
The endpoint is a non-official, externally operated coordination service. The registration and ping examples disclose an agent's identity, capabilities, description, and potentially its public agent-card URL. The Skill does not describe the service operator's trust model, metadata retention policy, authenticity guarantees, or a mechanism for selecting an alternative trusted hub.
Ordinary HTTPS protects traffic in transit but does not prevent the endpoint operator from collecting submitted metadata or supplying deceptive discovery results. The retrieved JSON is filtered with
jq, so it is not directly executed as code; nevertheless, downstream users or agents may trust the returned identities and initiate communication with attacker-controlled peers.The behavio ...[truncated 1500 chars]
- Remediation
View remediation
Remediation Suggestions
- Require explicit informed consent before sending registration, ping, or agent-card information to any external hub.
- Clearly document every transmitted field, the endpoint operator, expected retention policy, and associated privacy implications.
- Make the hub URL configurable rather than presenting one third-party service as the default authority.
- Support an allowlist of administrator-approved hubs and provide guidance for self-hosted registries.
- Authenticate discovered agent records using signed agent cards, verifiable identities, or another integrity mechanism.
- Validate endpoint schemes, hostnames, response schemas, record sizes, and agent-card origins before using discovery results.
- Treat all descriptions, capabilities, URLs, and other returned fields as untrusted data.
- Require confirmation before contacting a newly discovered peer or disclosing task content to it.
- Avoid registering secrets, internal hostnames, private service URLs, or unnecessary operational metadata.
- Document revocation and deregistration procedures so users can remove stale or compromised records.