other
Note
- Location
- SKILL.md:36
- Finding
- Unnecessary Third-Party Agent and Paid-Service Registration## Vulnerability Details **File Location**: `SKILL.md`, lines 36–49 **Vulnerability Type**: External Coordination Registration **Risk Level**: Low ### Vulnerable Code ```bash # Join ClawSwarm curl -s -X POST "https://onlyflies.buzz/clawswarm/api/v1/agents/register" \ -H "Content-Type: application/json" \ -d '{"name": "YOUR_NAME", "capabilities": ["social", "posting", "content"]}' # Register cross-posting service (earn HBAR!) curl -s -X POST "https://onlyflies.buzz/clawswarm/api/v1/services/register" \ -H "Authorization: Bearer YOUR_AGENT_ID" \ -H "Content-Type: application/json" \ -d '{"agentId":"YOUR_AGENT_ID","name":"cross_post","description":"Post to Twitter + MoltX + Discord simultaneously","category":"social","pricing":"paid","price_hbar":3}' ``` ### Technical Analysis The skill is presented as a cross-platform content-posting utility, but it also instructs the operator to register an agent and a paid service with the unrelated third-party ClawSwarm marketplace hosted at `onlyflies.buzz`. Executing these commands transmits the selected agent name, advertised capabilities, agent identifier, service description, pricing status, and HBAR price to an external service. The second request uses `YOUR_AGENT_ID` as a bearer credential. Although the instructions do not directly expose a hardcoded secret, operators may provide a real identifier or credential without receiving guidance about its sensitivity, permissions, storage, revocation, or the third party's trust model. This behavior is explicitly documented and requires the operator to execute the commands, so it is not covert code execution. Nevertheless, it expands the skill's scope beyond content formatting and posting and may cause unintended external enrollment or marketplace exposure. ### Attack Path 1. An operator loads the skill expecting cross-platform content-posting functionality. 2. The operator follows the optional “Offer this as a Claw ...[truncated 1261 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the ClawSwarm registration section if external marketplace enrollment is not essential to the skill's core cross-posting purpose. 2. If the integration is retained, place it in a clearly separated, explicitly optional section requiring informed operator consent. 3. Document the third-party operator, privacy policy, transmitted data, retention policy, marketplace visibility, trust assumptions, and account-deletion procedure. 4. Explain whether the returned agent identifier is a credential, what permissions it grants, how it should be stored, and how it can be rotated or revoked. 5. Use a narrowly scoped, revocable authentication token rather than treating a general agent identifier as an unrestricted bearer credential. 6. Warn operators not to insert unrelated social-media API keys, bot tokens, or other platform credentials into these requests. 7. Provide a confirmation or dry-run step that displays all metadata and financial terms before creating the external service. 8. Keep marketplace registration in a separately reviewed integration so use of the core formatting or posting functionality cannot implicitly trigger external enrollment.