Agent Bridge Kit

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:42 AM UTC
• Version: 1.0.0

Overview

The skill is a real social-platform bridge, but it under-discloses credential-file use, Colony posting, and local token/log persistence.

Review the config before use, especially any credential paths and enabled platforms. Use dedicated low-privilege platform credentials, avoid pointing credential settings at arbitrary files, and expect post, crosspost, comment, upvote, and register commands to contact external services and potentially affect public accounts.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/lib/config.sh:38

Finding

Unrestricted Colony credential path can cause arbitrary local file disclosure

Content

View full analysis

/dev/null else cat "$cred_file" | tr -d '\n' fi } ``` From `scripts/adapters/colony.sh:52-54`: ```bash response=$(curl -s -w "\n%{http_code}" -X POST "$COLONY_API/auth/token" \ -H "Content-Type: application/json" \ -d "$(jq -n --arg key "$api_key" '{api_key: $key}')") ``` The default configuration at `bridge.json:19-22` is: ```json "colony": { "enabled": true, "credentials": "~/.config/colony/credentials.json", "auto_read": true } ``` ### Technical Analysis The Colony credential path is read directly from configuration and is only checked with `-f`. The implementation does not: - Restrict the path to a dedicated credential directory. - Require a specific filename or canonical path. - Reject symbolic links. - Verify file ownership or permissions. - Require a strict JSON credential schema. - Limit the amount of data read. For files not recognized as JSON by the first-line heuristic, the entire file is treated as a plaintext API key. It ...[truncated 1995 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/adapters/colony.sh:57

Finding

Colony bearer token cache is written without restrictive permissions

Content

View full analysis

/dev/null || stat -c %Y "$COLONY_TOKEN_CACHE" 2>/dev/null || echo 0) local now ``` From `scripts/adapters/colony.sh:57-60`: ```bash if [[ -n "$token" ]]; then # Cache the token mkdir -p "$(dirname "$COLONY_TOKEN_CACHE")" echo "$token" > "$COLONY_TOKEN_CACHE" echo "$token" ``` ### Technical Analysis The adapter caches a Colony JWT in a plaintext file without setting an explicit restrictive umask, directory mode, or file mode. The resulting permissions therefore depend on the process environment. Under a permissive umask, the token may be readable by other local users or processes. The default cache location can also resolve beneath the Skill project directory because `BRIDGE_DIR` is defined by the sourced utility script. This increases the chance that the cache is included in project backups, copied with the project, or exposed through overly broad project-directory permissions. The code also follows normal filesystem path resolution when reading and writing the cache. It does not check whether the cache path is a symbolic link or verify ownership before trusting an existing cached token. ### Attack Path 1. The user invokes an authenticated Colony command. 2. The adapter exchanges the configured API key for a JWT. 3. The adapter creates the cache directory using ambient permissions and writes the JWT using the caller's current umask ...[truncated 1080 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (13)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bridge.json (reported line 10)May include surrounding context.

json

"platforms": {
    "moltbook": {
      "enabled": true,
      "credentials": "~/.config/moltbook/credentials.json",
      "default_submolt": "general",
      "auto_read": true
    },

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bridge.json (reported line 21)May include surrounding context.

json

"platforms": {
    "moltbook": {
      "enabled": true,
      "credentials": "~/.config/moltbook/credentials.json",
      "default_submolt": "general",
      "auto_read": true
    },

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill documents commands that perform live external write actions such as posting, cross-posting, commenting, upvoting, and account registration, but it does not clearly warn users that these commands will immediately affect third-party platforms. In an agent context, this increases the risk of unintended outbound actions, spam, reputation damage, and accidental use of real credentials or production accounts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script reads a Colony API key from credentials or the COLONY_API_KEY environment variable, exchanges it for a JWT over the network, and caches that token to a local file. While there are internal comments and error logs, there is no user-facing warning or explicit disclosure that credentials will be read and an auth token will be stored on disk.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/adapters/colony.sh (reported line 51)May include surrounding context.

sh

api_key="$(get_api_key)" || return 1

  local response http_code body_resp
  response=$(curl -s -w "\n%{http_code}" -X POST "$COLONY_API/auth/token" \
    -H "Content-Type: application/json" \
    -d "$(jq -n --arg key "$api_key" '{api_key: $key}')")
  http_code=$(echo "$response" | tail -1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The post command sends user-supplied title, body, tags, and colony identifiers to the Colony API via HTTP POST. Although network posting is part of the adapter's purpose, this file does not provide a user-facing disclosure at the operation point about transmitting content to an external service.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/adapters/colony.sh (reported line 110)May include surrounding context.

sh

fi

  local response http_code body_resp
  response=$(curl -s -w "\n%{http_code}" -X POST "$COLONY_API/posts" \
    -H "$(auth_header)" -H "Content-Type: application/json" -d "$payload")
  http_code=$(echo "$response" | tail -1)
  body_resp=$(echo "$response" | sed '$d')

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/adapters/colony.sh (reported line 131)May include surrounding context.

sh

fi

  local response http_code body_resp
  response=$(curl -s -w "\n%{http_code}" -X POST "$COLONY_API/posts" \
    -H "$(auth_header)" -H "Content-Type: application/json" -d "$payload")
  http_code=$(echo "$response" | tail -1)
  body_resp=$(echo "$response" | sed '$d')

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file-level comments frame the adapter as read-oriented and imply write behavior is not yet present. However, the implemented cmd_register function sends a POST request to /api/register, which is a write-like external action already available in the code.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

This command performs an outbound POST to a remote endpoint, sending locally sourced metadata from configuration and arguments. While the transmission is over HTTPS and appears functionally legitimate, any external transmission in an agent adapter is security-relevant because it can disclose environment-specific information or be triggered in automation without strong user awareness.

Content

Scanner excerpt · scripts/adapters/foragents.sh (reported line 167)May include surrounding context.

sh

--arg ownerUrl "$owner_url" \
    '{name: $name, platform: $platform, ownerUrl: $ownerUrl}')

  curl -sS -X POST "$API_BASE/api/register" \
    -H "Content-Type: application/json" \
    -d "$payload" | jq '{
      platform: "foragents",

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The register command transmits agent metadata, including agent name and homepage URL, to an external service without any interactive warning, confirmation, or prominent disclosure at the point of execution. In an agent-skill context, this increases the risk of unintended outbound sharing of local configuration-derived metadata when a caller invokes registration without understanding the privacy implications.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/adapters/moltbook.sh (reported line 29)May include surrounding context.

sh

'{title: $title, body: $body, submolt: $submolt}')

  local response http_code body_resp
  response=$(curl -s -w "\n%{http_code}" -X POST "$MOLTBOOK_API/posts" \
    -H "$(auth_header)" -H "Content-Type: application/json" -d "$payload")
  http_code=$(echo "$response" | tail -1)
  body_resp=$(echo "$response" | sed '$d')

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The crosspost command persistently records post titles, timestamps, and platform results to data/crosspost-log.json without any explicit user disclosure, opt-in, retention control, or permission hardening. In an agent skill context, persisted activity logs can unintentionally expose sensitive prompts, post metadata, or behavioral history to other local users, backups, or later components that read the workspace.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.