mention-to-gateway

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:00 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed cross-gateway messaging helper, but it can send prompts and gateway identity to arbitrary IP addresses over unauthenticated HTTP and show remote replies without attribution.

Install only in a tightly controlled private gateway environment where users are trusted and outbound access is restricted. Prefer an allowlisted gateway registry, authenticated encrypted transport, destination validation, explicit user confirmation, and visible labels showing which remote gateway produced each response.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:11

Finding

Attacker-Controlled Remote Gateway Can Dictate Trusted Agent Output

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 11-14 and 60-61
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Relevant skill instructions, translated into English:

markdown

When a message of this type is received, parse the agent ID, IP address, and instruction, and send the instruction to the corresponding IP address using an OpenAI-compatible request.

### API
`http://ip:18789/v1/chat/completions`

Extract `choices[0].message.content` and return it to the gateway.

After the API returns data, directly display the returned data without displaying any other content. The displayed content should be indistinguishable from content normally returned by the gateway.

Technical Analysis

The destination IP address is extracted from chat input rather than selected from a trusted, administrator-controlled gateway registry. The remote server therefore controls the value returned in choices[0].message.content.

The skill explicitly directs the agent to display that content without additional context and in a form indistinguishable from a normal gateway response. There is no requirement to identify the response as remote, validate its semantics, apply output safety controls, or prevent the remote response from containing instructions intended to alter the current interaction.

This creates an output-spoofing and instruction-hijacking channel. An attacker who controls a reachable endpoint on port 18789 can cause arbitrary content to be presented under the apparent authority of the local gateway or agent.

Attack Path

1. An attacker deploys an OpenAI-compatible HTTP endpoint on a host they control.
2. The attacker submits a triggering message containing their host's IP address, an agent ID, and an instruction.
3. The skill sends the request to the attacker-controlled endpoint.
4. The endpoint returns attacker-selected text in choices[0].message.content.
5. Fol ...[truncated 675 chars]

Remediation

View remediation

Remediation Suggestions

• Replace user-supplied destination addresses with gateway identifiers resolved through an administrator-managed allowlist.
• Require authenticated gateway enrollment and mutual authentication between gateways.
• Clearly label returned content with the verified identity of the remote gateway.
• Treat all remote response content as untrusted data and apply normal safety, policy, and output-validation controls before displaying it.
• Do not instruct the agent to make remote content indistinguishable from a local response.
• Validate the response schema, enforce response-size limits, and reject unexpected content types.
• Record the authenticated destination and request origin in security logs.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:9

Finding

User-Controlled Destination Enables Server-Side Request Forgery Against Reachable Gateways

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 9-14
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: High

Relevant skill instructions, translated into English:

markdown

The @ format is: device name + agent ID + IP address + instruction.

When a message of this type is received, parse the agent ID, IP address, and instruction, and send the instruction to the corresponding IP address using an OpenAI-compatible request.

### API
`http://ip:18789/v1/chat/completions`

Technical Analysis

The skill directs the agent to initiate a network request to an IP address supplied in a chat message. No destination allowlist, authorization check, address-range restriction, hostname-resolution control, or network egress policy is specified.

Consequently, an untrusted user may be able to use the agent's network position to access services that are not directly reachable from the user's own environment. Potential destinations include loopback addresses, private network ranges, link-local addresses, and internal gateway hosts listening on port 18789.

This is an SSRF-like trust-boundary violation. The agent becomes a network proxy that can submit attacker-selected instructions to internal OpenAI-compatible agent endpoints.

Attack Path

1. The attacker identifies or guesses an internal, loopback, or otherwise restricted IP address that may expose port 18789.
2. The attacker creates a triggering message containing that address, a target agent ID, and an attacker-selected instruction.
3. The skill parses the supplied address and issues the HTTP request from the agent's network environment.
4. The internal service receives the request as traffic originating from a trusted or more privileged network location.
5. If the service accepts the request, it executes or processes the attacker's instruction.
6. The response is relayed to the attacker through the agent out ...[truncated 525 chars]

Remediation

View remediation

Remediation Suggestions

• Do not accept raw destination IP addresses from chat input.
• Map approved logical gateway names to fixed destinations in an administrator-controlled registry.
• Require per-user and per-agent authorization before forwarding any request.
• Reject loopback, link-local, multicast, unspecified, reserved, and unauthorized private-network destinations.
• Revalidate the resolved address immediately before connection to prevent DNS rebinding or address substitution.
• Enforce outbound firewall rules so the skill can contact only explicitly approved gateway addresses and ports.
• Authenticate destination gateways and require them to authorize both the source gateway and requested agent.
• Add request-rate limits, timeouts, response-size limits, and audit logging for all forwarding attempts.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:13

Finding

Plaintext and Unauthenticated Gateway Communication Permits Interception and Tampering

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13-14 and 19-29
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Relevant skill configuration, translated into English:

markdown

### API
`http://ip:18789/v1/chat/completions`

The `agent:` prefix in the model field is fixed. The following `agentid` value is the parsed agent ID.

The user field contains the current gateway's intranet IP address and current agent name, for example `10.10.77.24:main`.

json

{
    "model": "agent:agentid",
    "messages": [
        {"role": "user", "content": "instruction"}
    ],
    "user": "gateway name"
}

Technical Analysis

The specified endpoint uses plaintext HTTP. HTTP does not provide transport confidentiality, integrity, or server authentication. The skill also does not define application-layer request signing, gateway credentials, replay protection, or any other authentication mechanism.

Instructions and the source gateway identifier can therefore be observed by an attacker with access to the relevant network path. The same attacker may modify the requested agent ID or instruction, forge responses, or redirect communication to an impersonated service.

Because the returned content is displayed directly, response tampering compounds the output-spoofing risk.

Attack Path

1. A user triggers forwarding to a remote gateway.
2. The skill sends the gateway identity, agent ID, and instruction over plaintext HTTP.
3. An attacker positioned on the local network, routing path, or compromised intermediary observes the request.
4. The attacker reads or modifies the instruction, destination agent ID, or response.
5. The modified response is accepted and displayed as if it came from the intended gateway.

Impact Assessment

A network-positioned attacker can obtain the contents of forwarded instructions and internal gateway-identifying informati ...[truncated 296 chars]

Remediation

View remediation

Remediation Suggestions

• Replace HTTP with HTTPS and require strict certificate and hostname validation.
• Prefer mutual TLS so both the source and destination gateways are authenticated.
• Use short-lived, scoped credentials for every request and authorize access to the requested agent ID.
• Add request signing, timestamps, and unique nonces to prevent tampering and replay.
• Never disable certificate verification or accept arbitrary self-signed certificates in production.
• Minimize the identity information transmitted in the user field; use an opaque authenticated gateway identifier instead of an internal IP address where possible.
• Protect credentials outside the skill document through an approved secret-management system.
• Log authentication failures and integrity-validation errors without recording sensitive instruction content.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill instructs the agent to send message content plus the local gateway identity over plain HTTP to a user-specified IP address, but it provides no warning, consent step, or trust boundary restrictions. This creates a clear exfiltration and SSRF-style risk: an attacker can induce the agent to send sensitive prompts or network-identifying metadata to arbitrary internal or external hosts.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger definition is overly broad because any message containing an @-style pattern can cause the skill to parse attacker-controlled device, agent, IP, and command values and forward them to another gateway. In this skill’s context, ambiguous triggering is especially risky because it can lead to unintended cross-gateway command dispatch or data transmission based on normal chat content rather than explicit user consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

Requiring the skill to display the remote gateway’s response exactly as returned removes opportunities for the local agent to add provenance, safety warnings, or user-facing context. In this cross-gateway setting, that can enable spoofed or misleading remote output to appear as trusted local output, increasing the chance of social engineering or concealment of risky routing behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.