agent mcp bridge

• Outcome: Review
• Latest audit: May 28, 2026 · 2:08 PM UTC
• Version: 1.0.0

Overview

This skill is a coherent local agent messaging bridge, but it creates a persistent unauthenticated message channel with under-disclosed local data storage and auto-processing risk.

Review before installing. Use only on a trusted single-user machine, avoid sending secrets through the bridge, and do not enable heartbeat auto-processing unless you trust every local process and agent that can write to the inbox or reach localhost. If you use launchd, keep stop/unload steps handy and periodically delete or rotate the SQLite database and shared message files.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill instructs users to copy files, modify configuration, register a service, and use a filesystem fallback, all of which imply file read/write capability, yet it declares no permissions or safety boundary. This creates a transparency and consent problem because the skill can induce persistent local changes without clear capability disclosure.

Vague Triggers

Medium

• Confidence: 72% confidence
• Finding: The trigger language is broad enough to activate on generic requests about connecting agents or enabling messaging, which can cause the skill to be invoked in contexts where users did not intend local broker setup or cross-agent communication. In a skill that configures services and messaging infrastructure, over-broad activation increases the chance of unintended privacy or persistence side effects.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The setup steps direct users to copy server files, run a startup script, register a launchd auto-start service, and modify OpenClaw configuration, all of which are persistent system changes. The absence of an upfront warning or consent checkpoint makes these changes easier to perform without users understanding their durability or rollback requirements.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill is explicitly designed to transmit messages directly between agents, but it provides no privacy notice about the contents of those messages, retention in SQLite, or exposure through the filesystem fallback. Because agent-to-agent messages may contain prompts, secrets, or sensitive work product, lack of disclosure raises meaningful confidentiality risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document instructs agents to exchange messages by writing plaintext JSON into a shared local directory, but it provides no warning about confidentiality, tampering, or permissions. On a multi-user system or a host with other local processes, another user or process could read sensitive agent messages or inject forged ones, leading to data exposure or untrusted inter-agent commands.

Missing User Warnings

Low

• Confidence: 95% confidence
• Finding: The script automatically creates a virtual environment and installs Python dependencies the first time it is run, without any warning, prompt, or explicit consent. That behavior can unexpectedly execute package installation logic and network access, which increases supply-chain risk if requirements are compromised or if the user did not intend to modify the environment.

Session Persistence

Medium

• Category: Rogue Agent

Content

### 2. Register as a launchd service (macOS auto-start)

```bash
cp <skill-dir>/references/launchd-plist.md ~/Library/LaunchAgents/ai.openclaw.agent-bridge.plist
# Edit the plist to set correct paths, then:
launchctl load ~/Library/LaunchAgents/ai.openclaw.agent-bridge.plist
```

• Confidence: 94% confidence
• Finding: The same launchd section references a persistent plist-based auto-start mechanism, which is a legitimate but security-sensitive persistence technique. In the context of an inter-agent broker, this increases the window during which message handling and local service exposure remain active.

Session Persistence

Medium

• Category: Rogue Agent

Content

### 2. Register as a launchd service (macOS auto-start)

```bash
cp <skill-dir>/references/launchd-plist.md ~/Library/LaunchAgents/ai.openclaw.agent-bridge.plist
# Edit the plist to set correct paths, then:
launchctl load ~/Library/LaunchAgents/ai.openclaw.agent-bridge.plist
```

• Confidence: 94% confidence
• Finding: The same launchd section references a persistent plist-based auto-start mechanism, which is a legitimate but security-sensitive persistence technique. In the context of an inter-agent broker, this increases the window during which message handling and local service exposure remain active.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
cp <skill-dir>/references/launchd-plist.md ~/Library/LaunchAgents/ai.openclaw.agent-bridge.plist
# Edit the plist to set correct paths, then:
launchctl load ~/Library/LaunchAgents/ai.openclaw.agent-bridge.plist
```

• Confidence: 90% confidence
• Finding: The instruction to edit and place a plist in the user's LaunchAgents directory contributes to persistence by preparing the system to auto-start the broker. Even if intended for convenience, it changes startup behavior and can leave background messaging infrastructure running longer than expected.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
cp <skill-dir>/references/launchd-plist.md ~/Library/LaunchAgents/ai.openclaw.agent-bridge.plist
# Edit the plist to set correct paths, then:
launchctl load ~/Library/LaunchAgents/ai.openclaw.agent-bridge.plist
```

### 3. Add to OpenClaw config

• Confidence: 93% confidence
• Finding: The same line also references the persistent plist path while activating it, reinforcing that the broker will remain configured beyond the current session. In this skill's context, persistence increases the risk of unnoticed continued message storage and local service exposure.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
cp <skill-dir>/references/launchd-plist.md ~/Library/LaunchAgents/ai.openclaw.agent-bridge.plist
# Edit the plist to set correct paths, then:
launchctl load ~/Library/LaunchAgents/ai.openclaw.agent-bridge.plist
```

### 3. Add to OpenClaw config

• Confidence: 93% confidence
• Finding: The same line also references the persistent plist path while activating it, reinforcing that the broker will remain configured beyond the current session. In this skill's context, persistence increases the risk of unnoticed continued message storage and local service exposure.

Session Persistence

Medium

• Category: Rogue Agent

Content

# Filesystem Bridge (Fallback)

Zero-infrastructure fallback when the MCP server is unavailable. Both agents read/write JSON files to a shared directory.

## Setup

• Confidence: 88% confidence
• Finding: This fallback design creates local session persistence by storing agent communications as JSON files in a shared directory, which can retain sensitive prompts, outputs, and coordination data beyond their immediate use. Because the guidance also notes manual cleanup, residual data may accumulate and be accessible to other local users, processes, backups, or forensic recovery.

Session Persistence

Medium

• Category: Rogue Agent

Content

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>ai.openclaw.agent-bridge</string>

• Confidence: 84% confidence
• Finding: The file documents a launchd plist that configures a process to run at load and remain alive, which is a persistence mechanism on macOS. In the context of an agent-to-agent bridge skill, this increases exposure because it establishes a continuously running local broker process that could be abused or left running longer than intended, even though the apparent intent is operational convenience rather than malware persistence.

Static analysis

No suspicious patterns detected.