Security audit

Firm Acp Bridge

Security checks for vulnerabilities and agentic risk

Overview

This skill needs Review because it tells agents to share API keys with autonomous sessions and schedule recurring host-level commands to work around sandbox limits without enough guardrails.

Install only if you trust the external fleet tools and will use this in a controlled environment. Treat injected provider keys as exposed to every recipient session, use short-lived scoped credentials, avoid PROXY_URL or CUSTOM_* unless reviewed, and do not schedule host-side cron commands without explicit human approval, fixed allowlisted jobs, logging, expiration, and a removal path.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:164
Finding: Explicit Sandbox Bypass Through Host-Accessible Scheduled Command Execution
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:105
Finding: Broad API Credential and Proxy Configuration Injection into Autonomous Sessions
Content: View full analysis
", "OPENCLAW_MODEL": "claude-3-5-sonnet-20241022" }, "dry_run": true } } ``` → Vérifie que les clés passent l'allowlist. Si `rejected` non vide, les clés sont invalides. **Étape 2 — Injection effective avant spawn :** ```json { "tool": "fleet_session_inject_env", "args": { "env_vars": { "ANTHROPIC_API_KEY": "", "OPENCLAW_MODEL": "claude-3-5-sonnet-20241022" }, "filter_tags": ["engineering", "quality"] } } ``` **Étape 3 — Spawn la session (via Gateway direct) :** ```json { "method": "sessions_spawn", "params": { "agent": "engineering", "reply_session": "main" } } ``` ### Clés autorisées (allowlist intégrée) ``` ANTHROPIC_API_KEY | OPENAI_API_KEY | OPENROUTER_API_KEY | GEMINI_API_KEY OPENCLAW_MODEL | OPENCLAW_PROVIDER | OPENCLAW_MAX_TOKENS CLAW_MODEL | CLAW_PROVIDER | PROXY_URL | CUSTOM_* ``` Jamais dans les logs — les valeurs sont masquées avec `****{last4}`. ``` ### Technical Analysis The Skill makes credential injection into non-main autonomous sessions a mandatory bootstrap step. The documented examples distribute long-lived provider API keys according to session tags, but the document does not show that tags are authenticated identities or authorization boundaries. Any process ...[truncated 2698 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill explicitly instructs operators to inject provider API keys into spawned or filtered autonomous sessions, but it does not prominently warn that any code or agent logic running in those sessions may access and exfiltrate those secrets. In this context, the capability materially expands secret exposure from the trusted main process to additional semi-autonomous execution contexts, making misuse or compromise more likely.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documentation recommends scheduling commands on the host-accessible main session specifically to bypass sandbox cron restrictions, but it does not clearly warn that these scheduled commands execute outside container isolation and may affect the host environment persistently. Even with a character allowlist, running scheduled commands on the main session increases the blast radius to host files, processes, network access, and repeated execution over time.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.