ClawHub
Back to skill

Security audit

Bole A2A

Security checks for vulnerabilities and agentic risk

Overview

The skill’s agent-network purpose is coherent, but it asks agents to send broad user profile data to an external service and to run a persistent listener that stores credentials and event data locally.

Review this skill carefully before installing. Use it only if you are comfortable sending user profile details and conversation content to the Bole service, and require explicit user approval before registration, profile updates, or sharing personal, confidential, location, financial, immigration, or business-sensitive details. Prefer manual polling over the persistent listener unless you can secure the API key, restrict file permissions, limit retention, and treat all inbound agent messages as untrusted data.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:54
Finding

Excessive Transmission of Sensitive User Profile Data

Content
View full analysis
", "role": "user", "parts": [{ "kind": "data", "data": { "skill": "register", "name": "", "user_description": "", "supply": { "expertise": [""], "experiences": [""], "opinions": [""], "local_knowledge": [""] }, "demand": { "active_questions": [""], "goals": [""], "decisions": [""], "wish_i_knew": [""] } } }] } } } ``` ### Technical Analysis The registration procedure instructs the agent to transmit a broad behavioral profile to the externally controlled service at `nexus-api-6gxx.onrender.com`. The requested information includes personal experiences, opinions, local knowledge, current questions, goals, and pending decisions. Although some profile information supports the Skill's matching functionality, collecting every category by default is broader than the minimum data needed to perform an individual knowledge query. The instructions do not require: - Explicit informed consent before registration. - Field-level confirmation before disclosure. - Removal of personally identifiable or confidential information. - A query-only or anonymous operating mode. - Disclosure of reten ...[truncated 1815 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:241
Finding

Persistent Listener Stores Credentials and Untrusted Event Data Insecurely

Content
View full analysis
" PENDING_FILE="bole-events-pending.jsonl" LOG_FILE="bole-events.log" echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] SSE listener starting..." >> "$LOG_FILE" curl -s -N \ -H "Authorization: Bearer $BOLE_KEY" \ -H "Accept: text/event-stream" \ "$BOLE_URL/api/events/stream" 2>>"$LOG_FILE" | while IFS= read -r line; do # Skip empty lines and "event:" prefixes [[ -z "$line" || "$line" == event:* ]] && continue # Extract JSON from "data: {...}" lines if [[ "$line" == data:* ]]; then json="${line#data: }" echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] $json" >> "$LOG_FILE" echo "$json" >> "$PENDING_FILE" fi done echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] SSE connection closed" >> "$LOG_FILE" ``` ### Technical Analysis The reference listener encourages placing a bearer credential directly in a persistent shell script. Anyone able to read that file can recover the API key. The script also creates predictable log and queue files using the process's default `umask`, without explicitly enforcing owner-only permissions. All server-supplied `data:` content is appended verbatim to both `bole-events.log` and `bole-events-pending.jsonl`. The implementation does not impose: - Event-size or total-file-size limits. - JSON schema validation. - Event-type allowlisting. - Log rotation or retention limits. - File permission requirements. - Symlink protections or safe exclusive file creation. - Content sanitization before later agent processing. Because messages can originate from other agents, queued event content crosses an untrusted boundary. If later supplied directly to an agent as instruct ...[truncated 2086 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The registration flow instructs the agent to collect and transmit a rich profile about the user, including expertise, experiences, opinions, local knowledge, active questions, goals, decisions, and hard-to-find interests. Sending this structured dossier to an external network without prominent warnings, minimization rules, or consent requirements creates a substantial privacy and profiling risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The usage guidance encourages asking other agents and sharing user expertise, goals, decisions, and local knowledge, but it does not require a clear disclosure that user information may be sent to external parties. This can cause unintended privacy leakage because operators may forward sensitive contextual details merely to improve matching or conversation quality.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly instructs the agent to run a persistent background SSE listener and provides a shell script to keep collecting events over time. That exceeds a normal request/response integration and can create unauthorized persistence, continuous network activity, and ongoing processing/storage of third-party data in ways a user may not expect or consent to.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The background listener example logs inbound event payloads and appends them to local files, potentially retaining conversation metadata or content from external agents. Without a retention notice, access controls, or minimization guidance, this can create an unbounded local cache of sensitive communications and API-adjacent operational data.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 362)May include surrounding context.

bash
# Check inbox every few minutes
curl -s https://nexus-api-6gxx.onrender.com/api/signals/inbox \
  -H "Authorization: Bearer <your_api_key>"

# Check active conversations

Static analysis

No suspicious patterns detected.