Security audit

Lobi A2A

Security checks for vulnerabilities and agentic risk

Overview

The skill largely matches its Lobi A2A purpose, but it gives an agent broad automated chat authority using stored bearer credentials with weak scoping and disclosure.

Install only for a dedicated Lobi agent account with a narrowly scoped, revocable token. Do not use autoJoin "always" unless you trust all inviters, restrict config-file permissions, avoid sensitive prompts, and verify the homeserver is the intended Lobi service before enabling automated room creation or polling.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: poller.js:18
Finding: Bearer Token Transmitted to an Unvalidated Configurable Destination
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: poller.js:99
Finding: Untrusted Room Messages Control Automated Conversation State and Recipients
Content: View full analysis
= ctx.maxTurns) { const otherAgent = config.userId === ctx.from ? ctx.to : ctx.from; const otherShort = otherAgent?.split(':')[0]; await sendRoomMessage(roomId, `✅ A2A 会话已完成\n\n@${otherShort} 感谢参与！`); saveProcessedEvent(event.event_id); activeRooms.delete(roomId); // 结束对话 console.log(`[${new Date().toISOString()}] 对话结束`); return true; } // 生成回复（简化版，不调用 LLM） const replies = [ '这个角度很有意思，能不能详细说说？', '我同意你的观点，另外我想补充一点...', '这是个好问题，我的看法是...', '确实如此，那如果换个角度思考呢？', '非常有见地！那接下来的实现步骤是什么？', ]; const reply = replies[Math.floor(Math.random() * replies.length)]; const nextAgent = config.userId === ctx.from ? ctx.to : ctx.from; const nextShort = nextAgent?.split(':')[0]; const newCtx = { ...ctx, turns: ctx.turns + 1 }; const messageBody = `${reply}\n\n上下文: ${JSON.stringify(newCtx)}\n\n@${nextShort}`; const sent = await sendRoomMessage(roomId, messageBody); ``` ### Technical Analysis The poller treats JSON embedded in ordinary room-message text as authoritative A2A session state. Acceptance requires only that: - The even ...[truncated 2381 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: README.md:144
Finding: Global Automatic Room Joining Exceeds Least-Privilege Requirements
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (15)

Credential Access

High

Category: Privilege Escalation
Confidence: 85% confidence
Finding: The documentation explicitly tells users to substitute a real access token and repeatedly normalizes direct handling of bearer credentials. In context, this is a credential-management anti-pattern because operators may paste real tokens into persistent files, shared terminals, screenshots, or deployment manifests, enabling account takeover if exposed.
Content: Scanner excerpt · README.md (reported line 80)May include surrounding context.
md
**注意：修改以下值为你自己的：** - `@agent:lobi.lobisland.com` → 你的 Lobi User ID - `syt_xxx` → 你的 Lobi Access Token ### 3. 安装并启用 Skill

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The code only implements a narrow polling/reply loop for an already-existing room. It reads local credentials, polls messages over HTTP, checks for mention plus embedded a2a_init JSON context, sends simple preset replies, and marks processed events in a file. While this partially matches 'manage multi-turn dialogue' and 'auto-stop' and does use HTTP calls, it materially does not match the broader declared purpose: there is no logic to trigger from user utterances, no room creation, no participant invitation, and no automatic room discovery/startup. The primary behavior is a standalone room poller, not the full described A2A skill flow.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger conditions are broad enough that ordinary conversation or casual mentions of @xxx could invoke the skill unintentionally. Because execution creates external rooms, invites users, and sends content to outside services, accidental triggering can cause unauthorized actions, privacy leakage, and spam-like behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The feature list advertises automatic group creation, invitations, and multi-round conversations, but does not warn that user prompts, agent outputs, and embedded context will be shared with other participants and persisted in chat history. In an agent-to-agent skill, silent forwarding of potentially sensitive prompts to external chat participants can create meaningful privacy and data-governance risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README instructs users to place long-lived access tokens in shell environment variables and a plaintext config file, but provides no security guidance about file permissions, secret rotation, or avoiding accidental disclosure through shell history, screenshots, backups, or source control. This increases the chance of credential leakage and unauthorized access to the Lobi account if the host or config is exposed.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 84% confidence
Finding: This duplicate finding points to the same persistence behavior: storing tokens in a long-lived local config file without security caveats. In an agent skill that can automatically join chats and act on behalf of an account, stolen persisted credentials could enable ongoing unauthorized messaging and data access.
Content: Scanner excerpt · README.md (reported line 37)May include surrounding context.
bash
# 创建配置文件目录 mkdir -p ~/.openclaw # 写入配置（替换为你的实际值） cat > ~/.openclaw/config.json << 'EOF'

Session Persistence

Medium

Category: Rogue Agent
Confidence: 84% confidence
Finding: This duplicate finding points to the same persistence behavior: storing tokens in a long-lived local config file without security caveats. In an agent skill that can automatically join chats and act on behalf of an account, stolen persisted credentials could enable ongoing unauthorized messaging and data access.
Content: Scanner excerpt · README.md (reported line 37)May include surrounding context.
bash
# 创建配置文件目录 mkdir -p ~/.openclaw # 写入配置(替换为你的实际值) cat > ~/.openclaw/config.json << 'EOF'

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill uses sensitive capabilities including environment variables, outbound network access, and implicit tool use (llm, message) but does not declare any tool scope or permissions boundary. This makes review and enforcement harder, increases the chance of over-privileged execution, and can allow unexpected external actions with stored credentials.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill description does not clearly warn that user input will be sent to an external LLM and that the skill will create Lobi rooms and invite participants automatically. This undermines informed consent and can expose potentially sensitive message content, identities, or discussion topics to third-party systems without the user's clear awareness.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The natural-language instructions, trigger phrases, and examples are entirely specified in Chinese, and the activation conditions are tied to Chinese expressions. There is no indication that users may choose another language or that the Chinese-only constraint is intentional and justified as region-specific.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This markdown file includes instructions and examples for state-changing operations such as creating rooms, inviting users, joining rooms, and sending messages, but it does not include any warning that these actions will modify remote chat state or contact other users. Under the markdown-specific warning rule, skills should disclose behaviors that can affect user data, privacy, or system integrity.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/lobi-api.md (reported line 235)May include surrounding context.
bash
# 1. 验证 token curl -H "Authorization: Bearer $LOBI_ACCESS_TOKEN" \ $LOBI_HOMESERVER/_lobi/client/v3/account/whoami # 2. 创建房间

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The README content and user-facing instructions are presented entirely in Chinese, and the document does not provide an alternative language option or explain that the skill is intentionally limited to a Chinese-speaking audience. This can violate language/locale policy where user-facing skills should not force a specific language without opt-in or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file's user-facing description and runtime messages are written entirely in Chinese, including startup, error, and usage output. For a general-purpose polling skill, this imposes a specific language without any opt-in or documented locale justification, which matches the language/locale policy violation category.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The poller reads a global OpenClaw config file from the user's home directory and pulls a bearer token and user identity from it, giving this skill access to broader account credentials than is disclosed in the skill description. Even though the code does not exfiltrate the token directly, loading undisclosed global credentials expands trust boundaries and could let the skill act on behalf of the user against the Lobi homeserver without explicit, skill-scoped consent.
Content: No source excerpt is available for this finding.