Agents-Manager-and-IM

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:24 PM UTC
• Version: 1.0.0

Overview

The skill is a real OpenClaw agent manager, but it exposes unauthenticated controls that can run shell commands and modify or delete OpenClaw agent data.

Review carefully before installing. Do not run this on a machine with valuable OpenClaw credentials or agent data unless you first add authentication, bind the server to 127.0.0.1, remove shell-based command construction, validate paths and IDs, replace rm -rf with safe filesystem deletion, remove and rotate the documented token if it was real, and back up ~/.openclaw.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (7)

T09 · Insecure Skill Coding Practices

Error

• Location: server-gemini.js:101
• Finding: Unauthenticated Remote Shell Command Injection Through Chat Messages<![CDATA[ ## Vulnerability Details **File Location**: `server-gemini.js:101-117`; equivalent vulnerable implementation in `server.js:151-201` **Vulnerability Type**: OS command injection **Risk Level**: Critical ### Vulnerable Code ```javascript app.post('/api/agents/:id/chat', async (req, res) => { try { const { id } = req.params; const { message, imageData } = req.body; if (!message && !imageData) { return res.status(400).json({ success: false, error: 'Message or image is required' }); } const agentId = id.replace('agent-', ''); const workspace = `workspace-${agentId}`; const workspacePath = path.join(CONFIG.workspaceDir, workspace); let taskMessage = message || 'Analyze this image'; if (imageData) { taskMessage = `${message || ''} [image uploaded]`.trim(); } const safeMessage = taskMessage.replace(/"/g, '\\"').replace(/\n/g, ' '); const { stdout } = await execCmd( `cd "${workspacePath}" && openclaw agent --agent ${agentId} --message "${safeMessage}" --json 2>&1` ); ``` The command is executed through a shell: ```javascript async function execCmd(cmd) { return new Promise((resolve, reject) => { exec(cmd, { shell: 'zsh' }, (error, stdout, stderr) => { if (error) reject(error); else resolve({ stdout, stderr }); }); }); } ``` ### Technical Analysis The request-controlled `message` is embedded directly into a command string passed to `child_process.exec()` with Z shell enabled. The attempted sanitization only escapes double quotation marks and replaces newline characters. It does not prevent command substitution or other shell interpretation. For example, command substitutions using `$(...)` or backticks remain active inside double-quoted strings. The request-controlled agent identifier is also interpolated into the command without being passed as a separately quoted process argument. The endpoint has no authentication or authorization. Consequently, this is ...[truncated 1122 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove `exec()` and all string-based shell command construction. - Invoke OpenClaw with `execFile()` or `spawn()` and a fixed argument array: ```javascript const { spawn } = require('child_process'); const child = spawn( 'openclaw', ['agent', '--agent', agentId, '--message', taskMessage, '--json'], { cwd: workspacePath, shell: false, stdio: ['ignore', 'pipe', 'pipe'] } ); ``` - Validate agent IDs with a strict allowlist such as `^[a-z0-9][a-z0-9_-]{0,63}$`. - Resolve the agent from a trusted server-side registry rather than deriving command arguments directly from URL parameters. - Add authentication and per-operation authorization to every API endpoint. - Bind the service explicitly to `127.0.0.1` unless remote access is intentionally secured. - Add request rate limits, process timeouts, and output-size limits. - Add regression tests containing quotes, backticks, dollar signs, command substitutions, and shell metacharacters. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: server-gemini.js:21
• Finding: Unauthenticated Privileged Agent Management and Recursive Deletion<![CDATA[ ## Vulnerability Details **File Location**: `server-gemini.js:21,48-90,138-157`; equivalent endpoints in `server.js:25,79-148,253-290` **Vulnerability Type**: Missing authentication and authorization **Risk Level**: Critical ### Vulnerable Code ```javascript app.use(cors()); app.use(express.json({ limit: '50mb' })); app.use(express.urlencoded({ extended: true, limit: '50mb' })); app.post('/api/agents', async (req, res) => { try { const { name, description, model } = req.body; if (!name) return res.status(400).json({ success: false, error: 'Name is required' }); const agentId = `agent-${name.toLowerCase().replace(/\s+/g, '-')}`; const agentDir = path.join(CONFIG.agentsDir, agentId); await fs.mkdir(agentDir, { recursive: true }); const agentConfig = { id: agentId, name, description: description || '', model: model || 'bailian/qwen3.5-plus', workspace: `workspace-${name.toLowerCase()}`, createdAt: new Date().toISOString(), status: 'active' }; await writeJsonFile(path.join(agentDir, 'config.json'), agentConfig); } catch (error) { res.status(500).json({ success: false, error: error.message }); } }); app.delete('/api/agents/:id', async (req, res) => { try { const { id } = req.params; const agentDir = path.join(CONFIG.agentsDir, id); try { await fs.access(agentDir); } catch (e) { return res.status(404).json({ success: false, error: 'Agent not found' }); } await execCmd(`rm -rf "${agentDir}"`); } catch (error) { res.status(500).json({ success: false, error: error.message }); } }); ``` ### Technical Analysis The application exposes endpoints that create agent directories, modify global agent configuration, run agent conversations, and recursively delete agent directories. None of these endpoints authenticates the caller or checks whether the caller is authorized to manage the selected agent. Calling `cors()` without a rest ...[truncated 1413 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Require authenticated sessions or a securely managed API credential for every `/api` endpoint. - Enforce operation-specific authorization, especially for agent creation, chat execution, and deletion. - Configure CORS with an explicit trusted-origin allowlist and only the required methods and headers. - Add CSRF protection if cookie-based authentication is used. - Bind to `127.0.0.1` by default: ```javascript app.listen(PORT, '127.0.0.1'); ``` - Require explicit secure configuration before allowing non-loopback binding. - Replace `rm -rf` with `fs.rm()` after canonical path validation. - Require deletion confirmation or a short-lived authorization token for destructive operations. - Add rate limiting and security logging for all management actions. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: server-gemini.js:61
• Finding: Path Traversal and Filesystem Writes Through Unvalidated Agent and Workspace Names<![CDATA[ ## Vulnerability Details **File Location**: `server-gemini.js:61-80`; additional workspace input in `server.js:84-132,171-183` **Vulnerability Type**: Path traversal and unrestricted filesystem write **Risk Level**: High ### Vulnerable Code ```javascript const { name, description, model } = req.body; if (!name) return res.status(400).json({ success: false, error: 'Name is required' }); const agentId = `agent-${name.toLowerCase().replace(/\s+/g, '-')}`; const agentDir = path.join(CONFIG.agentsDir, agentId); await fs.mkdir(agentDir, { recursive: true }); const agentConfig = { id: agentId, name, description: description || '', model: model || 'bailian/qwen3.5-plus', workspace: `workspace-${name.toLowerCase()}`, createdAt: new Date().toISOString(), status: 'active' }; await writeJsonFile(path.join(agentDir, 'config.json'), agentConfig); await fs.writeFile( path.join(agentDir, 'IDENTITY.md'), `# ${name}\n\n- **Name:** ${name}\n- **Role:** Agent\n` ); await fs.writeFile( path.join(agentDir, 'SOUL.md'), `# ${name}\n\n_Be the best version of yourself_\n` ); ``` The default server additionally accepts a request-controlled workspace: ```javascript const { name, description, model, workspace } = req.body; const agentConfig = { id: agentId, name, description: description || '', model: model || 'bailian/qwen3.5-plus', workspace: workspace || `workspace-${name.toLowerCase()}`, createdAt: new Date().toISOString(), status: 'active' }; ``` ### Technical Analysis The only transformation applied to `name` is lowercasing and whitespace replacement. Path separators, traversal components, quotation marks, and other special characters remain permitted. `path.join()` normalizes traversal components but does not guarantee that the resulting path remains below the intended root. A crafted name can therefore influence where directories and predictable files such as `config.json`, `IDENTITY.md`, and `SOUL.md` are written. In `server ...[truncated 1267 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Accept only strict identifiers rather than arbitrary names for filesystem paths: ```javascript const SAFE_ID = /^[a-z0-9][a-z0-9_-]{0,63}$/; if (!SAFE_ID.test(agentId)) { return res.status(400).json({ success: false, error: 'Invalid agent identifier' }); } ``` - Keep the display name separate from the filesystem identifier. - Do not accept arbitrary workspace paths from clients. Resolve workspaces from a trusted server-side registry. - Canonicalize and verify every derived path: ```javascript const root = path.resolve(CONFIG.agentsDir); const target = path.resolve(root, agentId); if (!target.startsWith(root + path.sep)) { throw new Error('Path escapes the configured agent directory'); } ``` - Reject absolute paths, `.` and `..` components, path separators, control characters, and shell metacharacters. - Use safe file-creation flags where overwriting existing files is not intended. - Add tests for POSIX separators, Windows separators, encoded traversal sequences, absolute paths, and nested traversal. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: index.html:285
• Finding: Stored DOM Cross-Site Scripting Through Agent Metadata<![CDATA[ ## Vulnerability Details **File Location**: `index.html:285-314`; equivalent embedded interface in `server-gemini.js:321` **Vulnerability Type**: Stored DOM-based cross-site scripting **Risk Level**: High ### Vulnerable Code ```javascript async function loadAgents() { try { const response = await fetch(API_BASE + '/agents'); const data = await response.json(); agents = data.registered || []; const listEl = document.getElementById('agentList'); let html = ''; for (let i = 0; i < agents.length; i++) { const agent = agents[i]; const key = agent.id.replace('agent-', ''); const emoji = agentEmojis[key] || '🤖'; const active = agent.id === currentAgentId ? 'active' : ''; html += '<div class="agent-item ' + active + '" onclick="selectAgent(\'' + agent.id + '\')">'; html += '<div class="agent-name">'; html += '<span class="agent-emoji">' + emoji + '</span>' + agent.name; html += '</div>'; html += '<div class="agent-desc">' + (agent.description || '') + '</div>'; html += '</div>'; } listEl.innerHTML = html; } catch (error) { console.error('Failed to load agents:', error); } } ``` An escaping helper exists but is not used for the agent list: ```javascript function escapeHtml(text) { const div = document.createElement('div'); div.textContent = text; return div.innerHTML; } ``` ### Technical Analysis Agent names, descriptions, and IDs originate from the unauthenticated creation API and are persisted in the agent registry. The front end concatenates those fields into an HTML string and assigns the result to `innerHTML`. Because the fields are not encoded for their specific HTML and JavaScript contexts, attacker-provided markup can create executable elements or event handlers. The ID is particularly dangerous because it is placed inside an inline `onclick` JavaScript attribute. This is a stored vulnerability: the payload remains in the age ...[truncated 1023 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not construct the agent list using HTML string concatenation. - Create DOM elements and assign all untrusted values through `textContent`. - Register event handlers with `addEventListener()` instead of inline `onclick` attributes. - If HTML rendering is unavoidable, use a well-maintained sanitizer and context-appropriate output encoding. - Validate agent IDs, names, and descriptions on the server. - Add a restrictive Content Security Policy that disallows inline scripts and inline event handlers, for example with `script-src 'self'` and no `unsafe-inline`. - Consider storing sensitive conversation history outside JavaScript-readable `localStorage`. - Add XSS regression tests covering tags, event handlers, quote termination, SVG payloads, and malformed markup. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: cli.js:41
• Finding: Local Shell Command Injection in CLI HTTP Request Construction<![CDATA[ ## Vulnerability Details **File Location**: `cli.js:41-53,83-92,135-146`; similar construction in `register-existing.js:57-68` **Vulnerability Type**: OS command injection **Risk Level**: High ### Vulnerable Code ```javascript async function simpleFetch(endpoint, options = {}) { const { execSync } = require('child_process'); const url = API_BASE + endpoint; const method = options.method || 'GET'; let cmd = `curl -s -X ${method} "${url}"`; if (options.body) { cmd += ` -H "Content-Type: application/json" -d '${JSON.stringify(options.body)}'`; } try { const result = execSync(cmd, { encoding: 'utf-8', shell: 'zsh' }); return JSON.parse(result); } catch (error) { console.error('API request failed:', error.message); return { success: false, error: error.message }; } } ``` Request bodies include values entered by the CLI user: ```javascript const data = await simpleFetch('/agents', { method: 'POST', body: { name, description, model: model || 'bailian/qwen3.5-plus' } }); const data = await simpleFetch(`/agents/${agentId}/chat`, { method: 'POST', body: { message } }); ``` ### Technical Analysis The CLI serializes user-controlled values as JSON and embeds the result inside a single-quoted shell argument. JSON encoding does not escape single quotation marks because they have no special meaning in JSON. A single quote in a name, description, agent ID, or chat message therefore terminates the shell string. Any following shell syntax is then interpreted by Z shell because `execSync()` is explicitly invoked with `shell: 'zsh'`. The same unsafe request-construction pattern appears in `register-existing.js`. ### Attack Path 1. A user runs the CLI with an untrusted agent name, description, ID, or chat message. 2. The value contains a single quote followed by shell syntax. 3. `JSON.stringify()` preserves the single quote. 4. The generated value terminates the shell-quoted curl data argument. 5. Z shell interprets ...[truncated 478 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace curl shell commands with Node.js `fetch`, `node-fetch`, or the native `http` module. - If curl must be used, call it with `spawn()` or `execFile()` and an argument array while setting `shell: false`. - Never treat JSON serialization as shell escaping. - Validate endpoint components and HTTP methods against explicit allowlists. - Apply the same correction to `register-existing.js`. - Add tests using apostrophes, quotes, command substitutions, semicolons, redirection operators, and newline characters. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: README.md:42
• Finding: Credential-Like OpenClaw Operator Token Committed in Documentation<![CDATA[ ## Vulnerability Details **File Location**: `README.md:42-46` **Vulnerability Type**: Hardcoded credential or sensitive token disclosure **Risk Level**: High ### Vulnerable Code ```json { "openclawGateway": "http://127.0.0.1:18789", "openclawToken": "ZZitPPb3LZmDH2c_jYl9Xbub2NO1CrqntpGgF-LBEGM", "port": 3000 } ``` ### Technical Analysis The README contains a high-entropy value formatted as an OpenClaw Operator Token rather than an unmistakable placeholder. Static review cannot establish whether the token is currently active, expired, or synthetic. Nevertheless, publishing credential-like material is unsafe and conflicts with the project's claim that tokens are supplied only by users. Secrets committed to documentation remain available in repository history even after the current file is edited. ### Attack Path 1. An attacker obtains the source package or repository history. 2. The attacker extracts the documented Operator Token. 3. The attacker identifies a reachable OpenClaw Gateway associated with the token. 4. The attacker attempts Operator authentication using the exposed value. 5. If the token remains active or has been reused, the attacker gains the privileges associated with it. ### Impact Assessment If valid or reused, the token may permit unauthorized Operator access to OpenClaw services, agents, sessions, or administrative capabilities. Even if inactive, the example encourages insecure credential-handling practices and creates uncertainty requiring rotation. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Immediately revoke or rotate the exposed value if there is any possibility it was active. - Replace it with an unmistakable placeholder such as `YOUR_OPERATOR_TOKEN_HERE`. - Remove the value from repository history and distributed artifacts where practical. - Search logs, releases, forks, and package archives for copies. - Enable automated secret scanning and pre-commit credential detection. - Load real secrets from environment variables or a protected secret store. - Ensure secret-bearing configuration files are excluded from version control and created with restrictive filesystem permissions. ]]>

other

Warning

• Location: SECURITY.md:5
• Finding: Security Documentation Misrepresents Filesystem Privileges<![CDATA[ ## Vulnerability Details **File Location**: `SECURITY.md:5-18,29-36`; conflicting implementation in `server-gemini.js:61-80,138-157` **Vulnerability Type**: Misleading security and permission documentation **Risk Level**: Medium ### Conflicting Documentation and Code The security documentation describes the agent directory as read-only: ```markdown | `~/.openclaw/agents` | Read Agent configuration | Read-only | ``` The implementation writes configuration and identity files under that directory: ```javascript await fs.mkdir(agentDir, { recursive: true }); await writeJsonFile(path.join(agentDir, 'config.json'), agentConfig); await fs.writeFile(path.join(agentDir, 'IDENTITY.md'), identityContent); await fs.writeFile(path.join(agentDir, 'SOUL.md'), soulContent); ``` It also recursively deletes agent directories: ```javascript const agentDir = path.join(CONFIG.agentsDir, id); await fs.access(agentDir); await execCmd(`rm -rf "${agentDir}"`); ``` ### Technical Analysis The documented read-only permission model materially differs from the executable behavior. The service creates directories, writes multiple files, updates global state, invokes local commands, and recursively deletes agent data. The documentation also emphasizes Operator Token configuration, while the reviewed server implementations do not load `config.json` to authenticate their management APIs. Users may therefore believe the service has protections that are absent from the actual runtime. ### Attack Path 1. A user reviews the security document and concludes that the agent directory is only read. 2. The user starts the service without additional isolation or backups. 3. The unauthenticated service performs write and delete operations under `~/.openclaw`. 4. An attacker exploits the exposed API to alter or remove agent data. 5. The consequences exceed the permission scope disclosed to the user. ### Impact Assessment The mismatch can cause users to approve execution without unders ...[truncated 228 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Document all actual capabilities, including: - Creation and modification of files under `~/.openclaw/agents`. - Modification of `~/.openclaw/agents.json`. - Recursive deletion of agent directories. - Execution of the local `openclaw` command. - Browser storage of conversation history. - Network binding, CORS behavior, and authentication requirements. - Remove claims that the agent directory is read-only. - Clearly distinguish configuration examples from runtime-enforced security controls. - Add an explicit privilege and threat-model section. - Update the documentation whenever filesystem, networking, or authentication behavior changes. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (52)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill claims UI features like image upload, chat history, and message isolation, while the reported backend behavior instead manages agent directories, edits ~/.openclaw state, and runs host commands such as openclaw and rm -rf. This combination of overstated benign UI capabilities and understated privileged host actions is dangerous because it can cause users to underestimate the operational and destructive access being granted.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill claims UI features like image upload, chat history, and message isolation, while the reported backend behavior instead manages agent directories, edits ~/.openclaw state, and runs host commands such as openclaw and rm -rf. This combination of overstated benign UI capabilities and understated privileged host actions is dangerous because it can cause users to underestimate the operational and destructive access being granted.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill claims UI features like image upload, chat history, and message isolation, while the reported backend behavior instead manages agent directories, edits ~/.openclaw state, and runs host commands such as openclaw and rm -rf. This combination of overstated benign UI capabilities and understated privileged host actions is dangerous because it can cause users to underestimate the operational and destructive access being granted.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill claims UI features like image upload, chat history, and message isolation, while the reported backend behavior instead manages agent directories, edits ~/.openclaw state, and runs host commands such as openclaw and rm -rf. This combination of overstated benign UI capabilities and understated privileged host actions is dangerous because it can cause users to underestimate the operational and destructive access being granted.

Known Vulnerable Dependency: path-to-regexp==0.1.12 — 1 advisory(ies): CVE-2024-45296 (path-to-regexp vulnerable to Regular Expression Denial of Service via multiple r)

High

• Category: Supply Chain
• Confidence: 98% confidence
• Finding: path-to-regexp 0.1.12 is a real high-risk dependency issue because vulnerable route-matching regex generation can allow Regular Expression Denial of Service. In an Express-based internet-facing service, route parsing sits directly on the request path, so malformed requests may consume excessive CPU and degrade or halt service availability.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The server wraps shell execution in a generic helper and uses it for operationally sensitive actions, including invoking agents and deleting directories. In this file, user-influenced values such as agent IDs and message content are interpolated into shell command strings, which creates command-injection risk and also grants the web UI unnecessary destructive power for a chat manager.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The application builds shell commands from request-influenced values and executes them with `exec(..., { shell: 'zsh' })`. In the chat flow, `agentId` derived from `req.params.id`, `workspace` loaded from attacker-influenced config, and `message` are interpolated into a shell command with only partial escaping, which is insufficient against shell metacharacter expansion and option injection. In this skill context, the server is explicitly a multi-agent manager exposed over HTTP, so this path is core functionality and especially dangerous.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

});

/**
 * DELETE /api/agents/:id - 删除 Agent
 */
app.delete('/api/agents/:id', async (req, res) => {
  try {

• Confidence: 90% confidence
• Finding: The delete-agent capability is exposed through an unauthenticated HTTP endpoint and performs a destructive filesystem operation on a parameterized target. In this skill context, an agent-management platform is expected to handle privileged local resources, so exposing deletion over a broad API surface without access control makes abuse far more dangerous, potentially allowing arbitrary removal of managed agent data.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation instructs users to extract an Operator Token from a local OpenClaw file and place it into `config.json` without clearly warning that the token is a sensitive credential. This increases the risk of credential exposure through source control, backups, screenshots, or accidental sharing, which could allow unauthorized access to the OpenClaw gateway or agent environment.

Session Persistence

Medium

• Category: Rogue Agent

Content

node cli.js list

# 创建新 Agent
node cli.js create Judy "营销外展专家" bailian/qwen3.5-plus

# 与 Agent 对话
node cli.js chat agent-judy

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: This markdown file includes CLI commands for deleting an Agent and later shows a DELETE API example, but the document does not warn that these actions remove registered agents or describe the impact on associated configuration/workspace state. Under the markdown-specific warning rule, destructive behaviours that could affect user data or system integrity should be disclosed clearly.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 获取 Agent 列表
```bash
curl http://localhost:3000/api/agents
```

### 创建 Agent

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation instructs users to place an operator token directly into config.json without any privacy or secret-handling guidance. This increases the risk of credential exposure through filesystem leakage, screenshots, backups, or accidental source control commits, which could enable unauthorized access to the OpenClaw gateway.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The README content is entirely in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. The policy requires flagging language or locale constraints when they are imposed without user opt-in or clear justification.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This markdown file describes a DELETE endpoint for removing an Agent, but it does not include any warning about the destructive nature of the action or whether deletion is reversible. Under the markdown-specific warning criteria, destructive operations affecting user-managed resources should be disclosed clearly.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: This markdown file presents all safety and usage guidance exclusively in Chinese, including warnings and operational details. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale limitation is documented and justified.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill declares access to sensitive local resources and instructs the user to run Node.js code, but it does not explicitly declare any tool scope or permissions despite requiring shell, filesystem, and network-like capabilities. This weakens user visibility and consent around what the skill can do, especially given the broader behavior indicated by the accompanying static findings.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The skill’s natural-language instructions, headings, and warnings are predominantly presented in Chinese, which effectively imposes a specific language on users. The policy allows locale constraints only when they are optional or clearly justified, but this file does not offer an alternative language or explicit opt-in.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The manifest describes a multi-agent conversation management platform with UI features like chat history and image upload. In this CLI implementation, the skill invokes arbitrary shell commands via execSync and later constructs curl command strings for routine API access, introducing shell-execution capability that is not an obvious requirement of agent management itself.

External Transmission

Medium

• Category: Data Exfiltration

Content

const method = options.method || 'GET';
  const body = options.body ? JSON.stringify(options.body) : null;
  
  let cmd = `curl -s -X ${method} "${url}"`;
  if (body) {
    cmd += ` -H "Content-Type: application/json" -d '${body}'`;
  }

• Confidence: 95% confidence
• Finding: The CLI builds a shell command string for curl and inserts JSON request data directly into a single-quoted shell argument. If attacker-controlled input contains a single quote or shell metacharacters, it can break out of quoting and trigger command injection on the local machine, making this much more severe than ordinary external transmission.

External Transmission

Medium

• Category: Data Exfiltration

Content

const url = API_BASE + endpoint;
  const method = options.method || 'GET';
  
  let cmd = `curl -s -X ${method} "${url}"`;
  if (options.body) {
    cmd += ` -H "Content-Type: application/json" -d '${JSON.stringify(options.body)}'`;
  }

• Confidence: 97% confidence
• Finding: This second helper has the same core flaw: it interpolates JSON-serialized user-controlled body data into a shell command executed via zsh. Because create/chat inputs originate from CLI arguments or interactive input, a crafted value can inject arbitrary commands locally while appearing to be only API data.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The delete command performs an irreversible destructive action immediately on a supplied agent ID, with no confirmation prompt, dry-run mode, or force flag semantics. In a management CLI, this increases the chance of accidental deletion from user error, scripting mistakes, or copied wrong IDs.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The root HTML element sets lang="zh-CN", and the interface text and time formatting are also fixed to Chinese, indicating a mandatory locale choice. Per policy, forcing a specific language or locale without opt-in or documented regional justification is a natural-language policy violation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The application persists per-agent chat history, including user messages and image data references, in browser localStorage with no disclosure, retention notice, or consent. localStorage is readable by any script running on the origin and remains after logout/browser restart, so sensitive prompts or uploaded content can be exposed on shared devices or through same-origin XSS elsewhere in the app.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The code sends message text and imageData to the '/agents/{id}/chat' endpoint via fetch, which transmits potentially sensitive user content to a server. The UI text invites users to type and upload images, but does not disclose that this content will be sent to backend services.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.install_untrusted_source

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: cli.js:13

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: register-existing.js:51

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: server-gemini.js:27

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: server.js:31

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: server-gemini.js:14

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: server.js:15

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: config.example.json:2

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: config.json:2