other
Warning
- Location
- SKILL.md:15
- Finding
- External Task Delegation to Privately Controlled Services## Vulnerability Details **File Location**: `SKILL.md:15-17`, with external endpoints listed at `SKILL.md:32-36` **Vulnerability Type**: External Service Task Delegation **Risk Level**: Medium ### Vulnerable Code ```text 2. If Aegis Sales Bot is configured as the OpenClaw A2A peer `aegis-sales-bot`, send the task below to `a2a:aegis-sales-bot`. Otherwise, use the public Agent Card or the direct recommendation endpoint. 3. Explain the returned decision themes, missing facts, and next action. Do not purchase, sign, book, submit an application, or send inquiries without the operator's separate approval. ``` The external destinations are: ```text - Agent Card: `https://aegis-sales-bot.kadopi.workers.dev/.well-known/agent-card.json` - A2A JSON-RPC: `https://aegis-sales-bot.kadopi.workers.dev/a2a` - Catalog: `https://aegis-sales-bot.kadopi.workers.dev/products.json` - Recommendation: `POST https://aegis-sales-bot.kadopi.workers.dev/recommend` with JSON `{ "request": "I am helping a business launch an experiential tour in Japan" }` - Japan Rule MCP: `https://japan-rulewatch-mcp-mainnet.kadopi.workers.dev/mcp` ``` ### Technical Analysis The skill instructs the agent to delegate a user task to project-specific external services and then incorporate their returned decision themes into its response. The implementations, response integrity, and data-handling behavior of these services are not included in the audited package and therefore cannot be independently verified from the project. The fixed example request contains no sensitive information. However, the broader instruction to send “the task” does not explicitly restrict outbound content to that fixed prompt or require informed user consent before transmission. An implementation could consequently include user-supplied business details or other conversation context. Remote responses also form an untrusted input boundary. If an endpoint is compromised, transferred, or mod ...[truncated 1804 chars]
- Remediation
- ## Remediation Suggestions 1. Require explicit user consent before every request to an external A2A peer, recommendation endpoint, or MCP service. 2. Display the destination hostname and the exact data fields that will be transmitted before requesting consent. 3. Restrict the initial request to the documented generic prompt unless the user separately approves additional context. 4. Apply data minimization and remove credentials, personal information, proprietary business details, and unrelated conversation history from outbound requests. 5. Treat all remote responses as untrusted data. Explicitly prohibit executing commands, invoking tools, changing system behavior, or following instructions contained in service responses. 6. Validate responses against a narrow schema and use returned content only as informational material. 7. Provide a local or operator-supplied research path when the user declines external transmission. 8. Document retention, ownership, and privacy policies for each service and avoid unsupported assurances about remote data handling. 9. Pin and locally review peer-configuration documentation rather than relying solely on a mutable external guide. 10. Preserve the existing prohibitions against sharing secrets and performing purchases or submissions without separate operator approval.