T09 · Insecure Skill Coding Practices
Error
- Location
index.ts:388- Finding
Unauthenticated Sender IDs Allow Trusted-Peer Impersonation
- Content
View full analysis
- Remediation
View remediation
Security audit
LocalUDPMessenger
Security checks for vulnerabilities and agentic risk
Overview
This local agent-messaging skill is mostly disclosed, but weak trust controls can let network messages trigger agent activity without the confirmation users are told to expect.
Review before installing. Use only on trusted networks, leave relayServer and hookToken disabled unless you explicitly need them, do not rely on always-confirm until enforcement is fixed, and avoid sharing secrets or project data through messages.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T01 · Skill Instruction Hijacking
Error
- Location
index.ts:236- Finding
Trusted UDP Messages Are Injected Verbatim into an Agent Prompt
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
index.ts:484- Finding
The Documented always-confirm Trust Mode Is Not Enforced
- Content
View full analysis
MAX_MESSAGE_SIZE) { messagePayload = messagePayload.slice(0, MAX_MESSAGE_SIZE) + `... [truncated from ${msg.payload.length} chars]`; addLog({ direction: "system", peerId, peerAddress: peerAddr, message: `Oversized message truncated (${msg.payload.length} chars → ${MAX_MESSAGE_SIZE})`, trusted: isTrusted, }); } recordExchange(peerId, "received"); addLog({ direction: "received", peerId, peerAddress: peerAddr, message: messagePayload, trusted: isTrusted, }); inbox.push({ from: peerAddr, fromId: peerId, message: messagePayload, timestamp: msg.timestamp || Date.now(), trusted: isTrusted, }); relayMessage({ type: "received", agentId, peerId, peerAddress: peerAddr, message: messagePayload, timestamp: Date.now(), }); ...[truncated 1916 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
index.ts:151- Finding
Optional Relay Sends Complete Message Contents over Unauthenticated Plaintext UDP
- Content
View full analysis
{ if (err) { console.error(`Relay send failed: ${err.message}`); } }); } ``` The receiver relays all inbound message bodies, including untrusted ones: ```typescript relayMessage({ type: "received", agentId, peerId, peerAddress: peerAddr, message: messagePayload, timestamp: Date.now(), }); ``` The sender similarly relays the complete outbound message: ```typescript relayMessage({ type: "sent", agentId, peerId: params.peer_id || "unknown", peerAddress: params.address, message: params.message, timestamp: Date.now(), }); ``` ### Technical Analysis When the optional relay is enabled, complete sent and received message bodies are copied to an arbitrary configured host using UDP. The data includes agent identifiers, peer identifiers, network addresses, message contents, and timestamps. No encryption, message authentication, destination pinning, integrity protection, or delivery authentication is used. Network observers can read traffic, and a spoofed or poisoned destination can receive all future messages. Because relay happens before any per-message sensitivity decision, it can disclose project deta ...[truncated 1528 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (32)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The manifest presents the skill as local UDP messaging, but the documented and detected behavior includes relaying messages to a monitoring server, reading wider config/environment data for webhook credentials, persisting trust state, and triggering local agent execution through /hooks/agent. This mismatch is dangerous because users may enable what appears to be simple LAN messaging without realizing it can expand trust, disclose message contents externally, and cause autonomous agent activation.
- Content
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
The skill explicitly supports sending messages to other agents, which is a legitimate feature for a messaging skill, but it is also an exfiltration pathway because it can move project data off-agent over the network. The context makes this more dangerous because the trigger phrases are broad and the skill additionally supports trust relationships, message logs, and optional relaying, increasing the chance that sensitive data could be transmitted if misused or socially engineered.
- Content
md --- name: udp-messenger description: Use when agents need to communicate over the local network — "send message to agent", "discover agents", "check for messages", "coordinate with other agents", "approve agent", "agent status", "add peer", "message log" metadata: openclaw: requires:
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md These tools are registered by the `openclaw-udp-messenger` plugin (`index.ts`):
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The relay feature forwards copies of all sent and received messages, plus metadata, to a separately configured server. That exceeds the stated local peer-to-peer LAN messaging purpose and creates a clear confidentiality boundary break, especially because message contents may include prompts, operational data, or secrets from agent interactions.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Incoming and outgoing message contents are silently copied to a relay server without user-facing warning or confirmation. This creates covert exfiltration of potentially sensitive agent communications and violates the expected local-network-only behavior described by the skill metadata.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
All message contents are forwarded in plain application data to a monitoring relay, creating straightforward disclosure of agent communications to another system. In the context of an agent messaging skill, messages may contain instructions, workflow state, or secrets, so broad replication materially increases exposure.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Trusted peer messages are embedded directly into an agent prompt and the agent is instructed to respond using udp_send, effectively turning remote network input into actionable prompt material. This is especially dangerous because trust is weakly managed elsewhere in the skill, so a LAN peer can induce prompt injection, autonomous responses, and tool-mediated side effects on the local agent.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill reads global configuration and environment-derived webhook tokens unrelated to basic UDP messaging, broadening its privilege and enabling control of local agent hooks without explicit user action. Accessing shared secrets from global config creates an unnecessary secret exposure and capability escalation path for a messaging plugin.
- Content
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
This skill explicitly enables network message sending and coordination with other agents, which creates a real exfiltration channel over the local network. Although the document includes guardrails against sending sensitive data, the capability materially increases the risk that an agent could disclose project data, relay instructions from untrusted peers, or participate in lateral coordination if invoked improperly.
- Content
md --- name: udp-messenger description: Use when agents need to communicate over the local network — "send message to agent", "discover agents", "check for messages", "coordinate with other agents", "approve agent", "agent status", "add peer", "message log" metadata: openclaw: requires:
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## Key Rules 1. **Trust requires user approval.** Never auto-approve a peer. Always show the user who is trying to contact them and let them decide. 2. **Conversation limits exist.** Each peer pair has a configurable exchange limit per hour (default: 10). Once reached, stop auto-responding and inform the user. The limit resets on a rolling hourly window. 3. **Trust mode is configurable.** In `approve-once` mode, a single approval lets messages flow. In `always-confirm` mode, every message needs user approval. 4. **Don't leak sensitive info.** Never share project secrets, credentials, or private data with other agents unless the user explicitly asks you to.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## Key Rules 1. **Trust requires user approval.** Never auto-approve a peer. Always show the user who is trying to contact them and let them decide. 2. **Conversation limits exist.** Each peer pair has a configurable exchange limit per hour (default: 10). Once reached, stop auto-responding and inform the user. The limit resets on a rolling hourly window. 3. **Trust mode is configurable.** In `approve-once` mode, a single approval lets messages flow. In `always-confirm` mode, every message needs user approval. 4. **Don't leak sensitive info.** Never share project secrets, credentials, or private data with other agents unless the user explicitly asks you to.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## Key Rules 1. **Trust requires user approval.** Never auto-approve a peer. Always show the user who is trying to contact them and let them decide. 2. **Conversation limits exist.** Each peer pair has a configurable exchange limit per hour (default: 10). Once reached, stop auto-responding and inform the user. The limit resets on a rolling hourly window. 3. **Trust mode is configurable.** In `approve-once` mode, a single approval lets messages flow. In `always-confirm` mode, every message needs user approval. 4. **Don't leak sensitive info.** Never share project secrets, credentials, or private data with other agents unless the user explicitly asks you to.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## Key Rules 1. **Trust requires user approval.** Never auto-approve a peer. Always show the user who is trying to contact them and let them decide. 2. **Conversation limits exist.** Each peer pair has a configurable exchange limit per hour (default: 10). Once reached, stop auto-responding and inform the user. The limit resets on a rolling hourly window. 3. **Trust mode is configurable.** In `approve-once` mode, a single approval lets messages flow. In `always-confirm` mode, every message needs user approval. 4. **Don't leak sensitive info.** Never share project secrets, credentials, or private data with other agents unless the user explicitly asks you to.
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documentation states that all sent and received messages can be forwarded to a central monitor server for human monitoring, but it does not clearly foreground the privacy and data-exfiltration implications at the point of configuration. In a messaging plugin where agents may exchange sensitive operational context, this creates a real risk that users enable centralized forwarding without informed consent or adequate data-handling controls.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README describes forwarding every sent and received message to a central monitoring server, including payload content, without a strong privacy and data-exposure warning. That creates a meaningful risk of sensitive prompt data, agent outputs, or internal coordination content being transmitted to infrastructure outside the local agent host or subnet.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The documentation says trusted peer messages can automatically trigger a full agent turn and be handled as if a user is talking to the agent. In an agent environment, this materially increases the risk of prompt-injection, unauthorized tool use, and cross-agent action chaining because another network peer can drive autonomous behavior without per-message human approval.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The README makes a broad safety claim that 'all traffic is local UDP' while elsewhere documenting an optional relay feature that forwards message contents to a monitoring server. This is a security-relevant contradiction because operators may rely on the local-only claim and unintentionally expose inter-agent messages beyond the host or LAN boundary.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The security section states peers are never auto-approved, but the documented udp_add_peer capability allows directly adding and trusting a peer without the discovery/approval flow. This misleading claim can cause users to overestimate the protection model and trust behavior of the plugin.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 78% confidence
- Finding
The skill declares network-oriented capabilities but does not constrain tool scope with an explicit permissions or allowed-tools section, while static analysis indicates broader capability access such as environment exposure. In a messaging plugin that also references hook tokens and broader configuration, missing scope boundaries increases the risk of unintended access to sensitive runtime data or future capability creep.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger phrases are broad and overlap with common requests such as 'send message', 'check for messages', and 'coordinate with other agents', which can cause the skill to be invoked in contexts the user did not specifically intend. Because this skill can move data across the network and potentially wake other agents, overbroad activation increases the chance of unintended disclosure or unsafe multi-agent interactions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documentation notes that relayServer forwards all messages to a human monitoring dashboard, but it does not present this as a prominent privacy and data disclosure warning at the point of configuration. Users may treat the feature as routine telemetry rather than full message forwarding, leading to unintended exfiltration of agent communications and project data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The wake-up feature causes inbound peer messages to trigger requests to the Gateway /hooks/agent endpoint, effectively converting network messages into agent execution events. Without a strong warning, users may not understand that enabling hook tokens broadens message exposure and can create an automatic processing path from local network input to active agent behavior.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The code can trigger agent turns via a local HTTP webhook based on incoming UDP traffic, which expands the skill from passive messaging into remote activation of agent behavior. Because trusted peer messages are transformed into prompts, a network peer can indirectly cause autonomous actions or prompt-injection-driven behavior in the local agent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill obtains webhook tokens from configuration and environment without clear user-facing disclosure, giving it access to sensitive credentials beyond its stated purpose. Even if not immediately leaked, silently consuming such secrets expands trust and can surprise operators about what the plugin is allowed to do.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The udp_add_peer tool is documented as adding a peer for messaging, but its implementation implicitly trusts that peer, including placeholder entries for non-responsive hosts. This undermines operator expectations and can cause later messages from that host or migrated IDs to be treated as trusted without a clear approval step.
- Content
Static analysis
Detected: suspicious.env_credential_access
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- index.ts:618