Comms Hub Bridge

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:44 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent agent messaging bridge, but it gives remote messages and shared bridge endpoints enough influence and data access that users should review it carefully before installing.

Install only if you trust the configured hub and participating agents, understand that uploaded files leave the local machine, and are willing to treat bridge messages as untrusted input. Avoid automatic processing or memory logging of message bodies without human review, use HTTPS only, and verify the hub enforces authentication and per-agent authorization.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (5)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:73

Finding

Untrusted Remote Messages Are Automatically Processed as Agent Instructions

Content

View full analysis

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:73

Finding

Attacker-Influenced Bridge Activity Can Be Written to Persistent Agent Memory

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/bridge-client.js:29

Finding

Sensitive Bridge Operations Lack Client Authentication and Authorization Credentials

Content

View full analysis

{ const data = body ? JSON.stringify(body) : null; const mod = HUB_PROTO === 'https' ? https : http; const opts = { hostname: HUB_IP || HUB_HOST, port: HUB_PORT, path: apiPath, method, headers: { ...(HUB_HOST && HUB_IP ? { 'Host': HUB_HOST } : {}), 'Content-Type': 'application/json', ...(data ? { 'Content-Length': Buffer.byteLength(data) } : {}) }, rejectUnauthorized: true }; const req = mod.request(opts, res => { let chunks = ''; res.on('data', c => chunks += c); res.on('end', () => { try { resolve(JSON.parse(chunks)); } catch { resolve(chunks); } }); }); req.on('error', reject); if (data) req.write(data); req.end(); }); } // --- API Methods --- const api = { health: () => request('GET', '/api/health'), send: (to, subject, body, priority) => request('POST', '/api/bridge/message', { from: MY_NAME, to, subject, body, priority: priority || 'normal' }), inbox: () => request('GET', `/api/bridge/inbox/${MY_NAME}`), allMessages: () => request('GET', '/api/bridge/all-messages'), ack: (messageId) => request('DELETE', `/api/bridge/inbox/${MY_NAME}/${messageId}`), files: () => request('GET', '/api/bridge/files'), state: () => request('GET', '/api/bridge/state'), }; ``` The file-upload request has the same problem: ```javascript const opts = { hostname: HUB_IP || HUB_HOST, port ...[truncated 2044 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/bridge-client.js:18

Finding

Configuration Can Silently Downgrade Sensitive Bridge Traffic to Plaintext HTTP

Content

View full analysis

{ const data = body ? JSON.stringify(body) : null; const mod = HUB_PROTO === 'https' ? https : http; ``` The same selection is used for file uploads: ```javascript const mod = HUB_PROTO === 'https' ? https : http; ``` The documentation explicitly permits both protocols: ```text | `hubProto` | No | `https` or `http` (default: `https`) | ``` ### Technical Analysis Every protocol value other than the exact string `https` selects Node.js's plaintext `http` module. This includes the documented `http` setting and accidental invalid values. Although the request options set `rejectUnauthorized: true`, that option only affects TLS connections and offers no protection when the HTTP module is selected. Messages and uploaded file contents can therefore travel without confidentiality, server authentication, or transport integrity. ### Attack Path 1. The configuration file or `BRIDGE_HUB_PROTO` environment variable is set to `http`, whether intentionally, accidentally, or by an attacker with configuration influence. 2. The client selects the plaintext HTTP module. 3. The client sends message content, inbox requests, acknowledgements, state queries, or file uploads over the network without TLS. 4. A network-positioned attacker observes or alters the tra ...[truncated 516 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/bridge-client.js:58

Finding

Unvalidated Identifiers Are Concatenated into Sensitive API Paths

Content

View full analysis

request('GET', '/api/health'), send: (to, subject, body, priority) => request('POST', '/api/bridge/message', { from: MY_NAME, to, subject, body, priority: priority || 'normal' }), inbox: () => request('GET', `/api/bridge/inbox/${MY_NAME}`), allMessages: () => request('GET', '/api/bridge/all-messages'), ack: (messageId) => request('DELETE', `/api/bridge/inbox/${MY_NAME}/${messageId}`), files: () => request('GET', '/api/bridge/files'), state: () => request('GET', '/api/bridge/state'), }; ``` The message ID is accepted directly from a command-line argument: ```javascript case 'ack': if (!args[0]) { console.log('Usage: ack '); process.exit(1); } console.log(JSON.stringify(await api.ack(args[0]), null, 2)); break; ``` ### Technical Analysis `MY_NAME` is obtained from configuration or an environment variable, while `messageId` is supplied through either the exported API or command line. Both values are directly interpolated into request paths without validation or percent-encoding. Values containing `/`, `?`, `#`, or traversal-like components can change the path structure or append a query string. The final effect depends on the remote server's routing and normalization behavior, but the client does not preserve these values as single path segments. The `ack` operation uses HTTP `DELETE`, making unintended route selection particularly sensitive. ### Attack Path 1. An attacker or unsafe caller controls `BRIDGE_AGENT_NAME`, `config.json`, or the `messageId` passed to `ack`. 2. Th ...[truncated 681 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

text

Sender → POST /api/bridge/message → Hub writes YAML to recipient inbox
Recipient polls inbox → GET /api/bridge/inbox/{name} → reads messages
Recipient acks → DELETE /api/bridge/inbox/{name}/{id} → message removed

Network Reference

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill documents environment-variable based configuration and external network operations, but it declares no explicit tool scope or permissions boundary. In an agent setting, that omission increases the chance the skill will be invoked with broader-than-necessary access to environment data and network-capable tooling, making unintended secret exposure or unauthorized bridge interaction more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The upload command instructs users to send arbitrary local files to the bridge server without any warning that file contents leave the local machine. In a multi-agent coordination skill, that creates a real risk of accidental exfiltration of sensitive data, credentials, logs, or private documents to an external service.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The client exposes administrative-style endpoints for reading all bridge messages and global bridge state, which exceed the stated per-agent messaging role and can enable broad confidentiality violations if an agent can invoke them. In a multi-agent bridge context, this is especially dangerous because messages may contain prompts, credentials, task outputs, or cross-machine coordination data belonging to other agents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The upload command reads an arbitrary local file and transmits its raw contents to the remote hub with no confirmation prompt, path restrictions, content filtering, or explicit disclosure warning. In an agent environment, this increases the risk of unintended exfiltration of sensitive local files if another component or prompt steers the agent into uploading secrets, system files, or proprietary artifacts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The acknowledge action is documented as removing a message, but the skill does not clearly warn that this is destructive and may permanently delete inbox contents. Users or agents may unintentionally destroy evidence, lose tasks, or prevent later review and replay of bridge communications.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

The manifest frames the skill as sending/receiving messages and checking the bridge inbox. The ack operation issues a DELETE against inbox messages, which is a state-changing mailbox management capability not mentioned in the description.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.