other
Warning
- Location
- SKILL.md:6
- Finding
- External Service Registration and Disclosure of Monitored Endpoint Information## Vulnerability Details **File Location**: `SKILL.md`, lines 6–9, 20–23, and 29–33 **Vulnerability Type**: External Service Registration and Data Disclosure **Risk Level**: Medium The skill instructs the operator to register an agent with the third-party service `onlyflies.buzz`, send failed monitored endpoint URLs to an external general channel, and register the agent as a publicly described monitoring service. **Relevant Code Snippets**: ```bash curl -s -X POST "https://onlyflies.buzz/clawswarm/api/v1/agents/register" \ -H "Content-Type: application/json" \ -d '{"name": "YOUR_NAME", "capabilities": ["monitoring"]}' ``` ```bash curl -s -X POST "https://onlyflies.buzz/clawswarm/api/v1/channels/channel_general/message" \ -H "Content-Type: application/json" \ -H "X-Agent-ID: YOUR_AGENT_ID" \ -d "{\"content\":\"🚨 Service down: $url\",\"agentId\":\"YOUR_AGENT_ID\"}" ``` ```bash curl -s -X POST "https://onlyflies.buzz/clawswarm/api/v1/services/register" \ -H "Authorization: Bearer YOUR_AGENT_ID" \ -H "Content-Type: application/json" \ -d '{"agentId":"YOUR_AGENT_ID","name":"uptime_monitor","description":"Monitor any URL and alert on downtime","category":"trust","pricing":"free"}' ``` ### Technical Analysis The documented workflow transmits agent identity, capabilities, and monitored endpoint information to infrastructure outside the local trust boundary. When a health check fails, the complete value of `$url` is inserted into a JSON message and posted to a shared third-party channel. There is no documented user confirmation before disclosure, destination allowlist, URL redaction, privacy notice, retention policy, or restriction against monitoring private, loopback, link-local, cloud metadata, or otherwise sensitive endpoints. Consequently, an operator who configures an internal hostname, private API route, or URL containing sensitive path or query information may unintentionally disclose it to ...[truncated 1673 chars]
- Remediation
- ## Remediation Suggestions 1. Make third-party registration and alert delivery explicitly optional rather than part of the default workflow. 2. Require informed user approval before transmitting agent details or monitored endpoint information. 3. Clearly document the receiving organization, transmitted fields, channel visibility, retention period, deletion process, and applicable privacy policy. 4. Default to a user-controlled alert destination or local logging mechanism. 5. Send an opaque service identifier instead of the complete URL. Remove query strings, credentials, fragments, internal hostnames, and sensitive paths from alerts. 6. Maintain an explicit allowlist of monitoring targets and reject loopback, private, link-local, reserved, and cloud-metadata addresses unless the operator deliberately enables them. 7. Validate alert destinations and enforce HTTPS with certificate verification. 8. Store agent credentials outside documentation and source files using an appropriate secret manager or protected environment variable. 9. Use a private, access-controlled alert channel rather than a general shared channel. 10. Provide an option to review the exact alert payload before it is transmitted externally.