Agentgate Clawhub

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:06 PM UTC
• Version: 1.0.4

Overview

This skill is mostly transparent about connecting agents to personal services, but it documents sensitive bearer-token access over plain HTTP and lightly describes bypassed write approval for high-impact services.

Install only if you control the agentgate server, use HTTPS or a private encrypted tunnel for any non-local connection, scope the API key tightly, and leave write bypass disabled unless you have explicitly accepted immediate changes to connected services.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:29

Finding

Bearer Token and Sensitive Service Data May Be Transmitted Over Plaintext HTTP

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 29–35 and 39–45
Vulnerability Type: Plaintext transmission of credentials and sensitive data
Risk Level: Medium

Vulnerable code snippet:

markdown

Once agentgate is running, configure these environment variables for your OpenClaw agent:

- `AGENT_GATE_URL` — agentgate base URL (e.g., `http://your-agentgate-host:3050`)
- `AGENT_GATE_TOKEN` — your agent's API key (create in the agentgate Admin UI → API Keys)

## Authentication

All requests require the API key in the Authorization header:

Authorization: Bearer $AGENT_GATE_TOKEN

text

markdown

## First Steps — Service Discovery

After connecting, discover what's available on your instance:

GET $AGENT_GATE_URL/api/agent_start_here Authorization: Bearer $AGENT_GATE_TOKEN

text

Returns your agent's config, available services, accounts, and full API documentation.

Technical Analysis

The documented configuration explicitly uses an http:// gateway URL while requiring a reusable bearer token in every request. HTTP provides neither transport confidentiality nor endpoint authentication. If the example is followed across an untrusted or compromised network, an on-path attacker can observe the Authorization header, capture the token, inspect sensitive request and response data, or modify traffic.

This network communication is necessary for the Skill's declared gateway functionality, and the token is not sent to an undisclosed fixed third party. However, permitting plaintext transport exceeds safe minimum-security requirements because HTTPS can provide the same functionality without exposing credentials and personal-service traffic.

Attack Path

1. An administrator configures AGENT_GATE_URL using the documented http://your-agentgate-host:3050 pattern.
2. The agent sends a request to the gateway with Authorization: Bearer $AGENT_GATE_TOKEN.
3. An attacke ...[truncated 1422 chars]

Remediation

View remediation

Remediation Suggestions

1. Require HTTPS for every non-loopback Agentgate connection and replace the plaintext example with an https:// URL.
2. Reject http:// gateway URLs at configuration or invocation time, except for explicitly authorized loopback-only development environments.
3. Use certificates issued by a trusted authority or securely distribute and pin a private certificate authority for internal deployments. Do not disable certificate validation.
4. Consider mutual TLS, a private VPN, or another authenticated encrypted tunnel when deploying the gateway on a separate host.
5. Scope each API key to only the services, accounts, endpoints, and operations required by its agent. Keep write-bypass disabled unless it is strictly necessary.
6. Rotate API keys periodically and immediately after suspected plaintext exposure. Support revocation and audit access performed with each key.
7. Document that mementos, messages, uploaded files, and request bodies may contain sensitive information and should not include secrets unless required and appropriately protected.
8. Add a prominent warning that approval-gated writes do not protect the confidentiality of bearer tokens or read responses transmitted over HTTP.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly advertises a 'Bypass mode' that allows write operations to execute immediately, but it does not pair that capability with a strong warning that human approval is being skipped and that the agent may directly modify external systems or personal data. In a skill that fronts sensitive services like GitHub, calendars, social accounts, messaging, and home automation, normalizing bypass mode without prominent cautions increases the chance that users or downstream agents enable unsafe write behavior without understanding the consequences.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.