Security audit

LocalUDPMessenger

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local agent messenger, but it can automatically wake the agent from network messages and relay full message contents, with trust controls that are weaker than documented.

Install only if you trust the LAN and understand that approved or spoofed peers may trigger agent activity. Keep relayServer and hookToken disabled unless you specifically need monitoring or automatic wake-up, do not send secrets through this channel, and do not rely on always-confirm or peer IDs as strong security controls until the implementation is fixed.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: index.ts:420
Finding: Spoofable UDP Peer Identity Enables Trusted-Peer Prompt Injection
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: index.ts:480
Finding: The Documented always-confirm Trust Mode Is Not Enforced
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: index.ts:91
Finding: Optional Relay Sends Complete Message Contents over Unauthenticated Plaintext UDP
Content: View full analysis
{ if (err) { console.error(`Relay send failed: ${err.message}`); } }); } ``` ```ts // Relay to monitoring server relayMessage({ type: "received", agentId, peerId, peerAddress: peerAddr, message: messagePayload, timestamp: Date.now(), }); ``` ```ts // Relay to monitoring server relayMessage({ type: "sent", agentId, peerId: params.peer_id || "unknown", peerAddress: params.address, message: params.message, timestamp: Date.now(), }); ``` ```ts if (params.key === "relay_server") { if ( !params.value || params.value === "off" || params.value === "disable" || params.value === "none" ) { relayEnabled = false; relayHost = ""; relayIp = ""; addLog({ direction: "system", peerId: "relay", peerAddress: "local", message: "Relay server disabled", trusted: true }); return { content: [{ type: "text", text: "Relay server disabled." }] }; } const parts = params.value.split(":"); const rHost = parts[0]; const rPort = parts.length > 1 ? parseInt(parts[1], 10) : 31415; await initRelay(rHost, rPort); } ``` ### Technical Analysis When r ...[truncated 2302 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (26)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared purpose emphasizes local LAN messaging, but the skill also supports forwarding all messages to a relay server, using a hook token, triggering local HTTP wake-up flows, and runtime reconfiguration of trust and relay settings. This mismatch can mislead users about data flows and trust boundaries, creating a real risk of silent message exfiltration and expanded control surfaces.
Content: No source excerpt is available for this finding.

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: udp-messenger description: Use when agents need to communicate over the local network — "send message to agent", "discover agents", "check for messages", "coordinate with other agents", "approve agent", "agent status", "add peer", "message log" metadata: openclaw: requires:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.
md
These tools are registered by the `openclaw-udp-messenger` plugin (`index.ts`):

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill can forward every sent and received message to a separately configured relay server, which materially expands its behavior beyond local peer-to-peer UDP coordination. This creates a clear confidentiality and scope-expansion risk: local agent communications may be silently exfiltrated to another host, including sensitive prompts, coordination data, and possibly secrets contained in messages.
Content: No source excerpt is available for this finding.

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: The skill is explicitly designed to send messages to other agents over the network, which creates a real exfiltration channel if the skill is invoked with sensitive content. Although the documentation includes some cautions, the broad trigger language and communication-focused functionality make it possible for data to be transmitted outside the local agent boundary if the user or agent mishandles content.
Content: Scanner excerpt · skills/udp-messenger/SKILL.md (reported line 3)May include surrounding context.
md
--- name: udp-messenger description: Use when agents need to communicate over the local network — "send message to agent", "discover agents", "check for messages", "coordinate with other agents", "approve agent", "agent status", "add peer", "message log" metadata: openclaw: requires:

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · CLAUDE.md (reported line 11)May include surrounding context.
md
## Key Rules 1. **Trust requires user approval.** Never auto-approve a peer. Always show the user who is trying to contact them and let them decide. 2. **Conversation limits exist.** Each peer pair has a configurable exchange limit per hour (default: 10). Once reached, stop auto-responding and inform the user. The limit resets on a rolling hourly window. 3. **Trust mode is configurable.** In `approve-once` mode, a single approval lets messages flow. In `always-confirm` mode, every message needs user approval. 4. **Don't leak sensitive info.** Never share project secrets, credentials, or private data with other agents unless the user explicitly asks you to.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · README.md (reported line 155)May include surrounding context.
md
## Key Rules 1. **Trust requires user approval.** Never auto-approve a peer. Always show the user who is trying to contact them and let them decide. 2. **Conversation limits exist.** Each peer pair has a configurable exchange limit per hour (default: 10). Once reached, stop auto-responding and inform the user. The limit resets on a rolling hourly window. 3. **Trust mode is configurable.** In `approve-once` mode, a single approval lets messages flow. In `always-confirm` mode, every message needs user approval. 4. **Don't leak sensitive info.** Never share project secrets, credentials, or private data with other agents unless the user explicitly asks you to.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.
md
## Key Rules 1. **Trust requires user approval.** Never auto-approve a peer. Always show the user who is trying to contact them and let them decide. 2. **Conversation limits exist.** Each peer pair has a configurable exchange limit per hour (default: 10). Once reached, stop auto-responding and inform the user. The limit resets on a rolling hourly window. 3. **Trust mode is configurable.** In `approve-once` mode, a single approval lets messages flow. In `always-confirm` mode, every message needs user approval. 4. **Don't leak sensitive info.** Never share project secrets, credentials, or private data with other agents unless the user explicitly asks you to.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · skills/udp-messenger/SKILL.md (reported line 91)May include surrounding context.
md
## Key Rules 1. **Trust requires user approval.** Never auto-approve a peer. Always show the user who is trying to contact them and let them decide. 2. **Conversation limits exist.** Each peer pair has a configurable exchange limit per hour (default: 10). Once reached, stop auto-responding and inform the user. The limit resets on a rolling hourly window. 3. **Trust mode is configurable.** In `approve-once` mode, a single approval lets messages flow. In `always-confirm` mode, every message needs user approval. 4. **Don't leak sensitive info.** Never share project secrets, credentials, or private data with other agents unless the user explicitly asks you to.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill documents an optional relayServer that forwards all sent and received messages to a central monitor server, but it does not present this as a prominent user-facing warning or consent requirement. In a messaging skill, this creates a meaningful transparency and privacy risk because operators may unknowingly route inter-agent content, including sensitive task data, to a third-party or centralized listener.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documentation shows several ways to configure and set the hook token, including at runtime, but does not clearly warn that this token is a credential that should be kept secret and not exposed in logs, screenshots, chat transcripts, or shell history. Because the token triggers agent wake-up through a webhook, compromise could allow unauthorized triggering or abuse of agent actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README documents forwarding every sent and received message to a central monitoring server, but does not present a strong, nearby warning that this may disclose sensitive prompts, agent outputs, or internal coordination data. In an agent-messaging plugin, message contents are likely to contain natural-language secrets or operational details, so operators need explicit informed consent before enabling such a feature.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documented design of full message logging plus optional forwarding of all messages to a monitoring server creates a direct data leakage path for agent conversations. Since agent-to-agent messages may include sensitive instructions, project context, or derived secrets, central collection materially increases confidentiality risk even if intended for observability.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The README makes a misleading security claim that all traffic stays on the local network, while the documented relay mode explicitly forwards copies of messages to another server. Even if relay is optional, this contradiction can cause operators to underestimate data exposure and enable the plugin in contexts where message confidentiality matters.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 78% confidence
Finding: The skill exposes networked messaging, relay, webhook wake-up, and likely environment-backed configuration, but the manifest does not declare any restrictive tool scope or permissions boundary. That increases the chance the agent can use capabilities beyond what a user would infer from the manifest and weakens least-privilege protections.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger phrases are broad and overlap with normal conversational requests like 'send message,' 'check for messages,' or 'agent status,' which can cause the skill to activate unexpectedly. Because this skill can communicate over the network and potentially forward data, overbroad activation increases the risk of unintended data sharing or trust changes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill mentions an optional relay server, but the description does not clearly and prominently warn that messages may be copied to a remote monitoring server. Users may reasonably assume communication stays local, so inadequate disclosure creates a meaningful confidentiality risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The relay feature forwards complete message contents off-host without a strong user-facing warning at the moment it is enabled or used. Even if intentionally configured, the lack of clear consent and disclosure increases the chance of inadvertent sensitive-data exposure through routine agent-to-agent communication.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Trusted UDP messages are automatically turned into a local HTTP webhook request that triggers a new agent turn, embedding attacker-controlled message content into the generated prompt. This converts a network message channel into an agent-invocation and prompt-injection surface, allowing any trusted peer—or a spoofed peer if trust is weak—to influence autonomous local agent behavior.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The plugin reads broader application configuration and environment variables to obtain a webhook token unrelated to basic UDP messaging. Accessing local credentials expands privilege and can be abused to invoke local control-plane actions, especially when paired with the wake-up mechanism that uses the recovered token.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill description uses broad phrases like 'send message to agent' and 'coordinate with other agents', which can match ordinary user requests and cause the skill to activate in more situations than intended. Because this skill enables network communication with other agents, accidental invocation expands the chance of unreviewed data sharing or interaction with untrusted peers.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documentation states that a relay server forwards all messages to a monitoring dashboard, but it does not prominently emphasize that message contents may leave the local peer-to-peer context and be copied to a central observer. Users may assume local-only communication and inadvertently expose sensitive project details or operational metadata.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The wake-up feature causes incoming trusted-peer messages to trigger a full agent turn through the Gateway hook, creating automatic message-driven execution flow. Without a strong warning, users may enable this without understanding that external network input can now initiate agent activity and potentially influence behavior more directly.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: L155 says 'Peers are never auto-approved — the user must explicitly trust each one', but the documented tool list includes udp_add_peer as 'Manually add and trust a peer' (L103). While user initiated trust is consistent, the absolute 'never auto-approved' phrasing contradicts the documented direct-trust flow and can mislead readers about actual trust behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The skill accesses webhook credentials from config and environment without explicit disclosure to the user, which weakens informed consent around secret access. While this is less severe than direct exfiltration, it is still a security-quality issue because the skill's stated purpose does not obviously require reading such credentials.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: index.ts:540