T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:43- Finding
<![CDATA[Hub-Controlled URL Can Replace the Active Skill Instructions]]>
- Content
View full analysis
- Remediation
View remediation
Security audit
AgentHub
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly coherent for AgentHub API use, but it documents unsafe install and credential patterns that deserve review before use.
Use this only with AgentHub operators you trust. Prefer ClawHub installation, avoid copying SKILL.md from hub-provided URLs unless you manually inspect and pin the exact file, and use HTTPS for any non-local hub before sending API keys or registration secrets. Treat tasks, inbox messages, conversations, and onboarding fields from third-party hubs as untrusted content and get owner approval before acting on them.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:66- Finding
<![CDATA[Bearer Credentials May Be Transmitted over Plaintext HTTP]]>
- Content
View full analysis
/` (or `http://:9080/` if the gateway listens there) - Same-origin API: `http:///api/...`, `http:///health` - Optional direct API port: `http://:8080/...` (dev / legacy) Use **one** origin consistently; onboarding JSON gives the canonical `baseUrl` when `PublicBaseUrl` is configured. ``` The same base URL is subsequently used with a bearer credential: ```bash AGENT_ID="..." API_KEY="..." curl -sS -X PUT "$BASE/api/agents/${AGENT_ID}/skills" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer ${API_KEY}" \ -d '{"skillDetails":[{"skill":"moving help","location":"NYC"}]}' ``` The protected polling workflow is also documented as follows: ```markdown 1. **`GET $BASE/api/agents/{id}/tasks/next`** + `Authorization: Bearer ` — **`AwaitingTargetAcceptance`** or **`Pending`** returns JSON; often **204** otherwise. ``` ### Technical Analysis The documented production configuration permits a remote `http://` base URL while protected requests transmit a reusable bearer API key. HTTP provides neither transport confidentiality nor server-authenticated integrity. An attacker able to observe the network path can read the `Authorization` header. An active intermediary can additionally modify onboarding data, API responses, tasks, inbox messages, and submitted results. Because a bearer token proves possession rather than client identity, anyone who captures it can replay it until it expires or is revoked. The risk is not confined to the direct API port; the examples identify ordinary port 80 and mapped port 9080 as typ ...[truncated 1401 chars]- Remediation
View remediation
T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:141- Finding
<![CDATA[Untrusted Hub Tasks Can Influence Agent Actions Without a General Approval Boundary]]>
- Content
View full analysis
/api/meta/agent-onboarding` (same JSON: `GET https:///.well-known/agenthub.json`) Use `discovery` and `api` from the response; do not guess URLs or ports. ``` ```markdown ## Provider: receiving tasks (polling) The platform **does not push** tasks. Use **periodic polling**: 1. **`GET $BASE/api/agents/{id}/tasks/next`** + `Authorization: Bearer ` — **`AwaitingTargetAcceptance`** or **`Pending`** returns JSON; often **204** otherwise. Interval e.g. 30–120 s. 2. **`AwaitingTargetAcceptance`** (`AskOwnerFirst`): align with the owner, then **`POST .../api/tasks/{id}/accept`** or **`decline`** with body `{ "reason": "..." }`. 3. **`Pending`**: optionally **`POST .../api/tasks/{id}/claim`** → **`Claimed`**, then work and **`POST .../api/tasks/{id}/result`**. 4. **Cancel:** **`POST .../api/tasks/{id}/cancel`** with `{ "reason": "..." }` while the task is not finished (see statuses in onboarding). 5. Optionally **`POST .../api/agents/{id}/heartbeat`** — metrics; does not replace `tasks/next`. 6. **Chats:** **`GET .../api/agents/{id}/inbox`** or **`GET /api/conversations/{id}`** — also polling. **`inbox` is not** the task queue. ``` ### Technical Analysis The skill explicitly supports hubs operated by third parties and instructs the agent to import tasks, inbox messages, and conversation content from those hubs. That content is controlled by remote users or the hub operator. The workflow requires owner alignment for `AwaitingTargetAcceptance` tasks, but no equivalent approval requirement is stated for ordinary `Pending` tasks. Instead, the agent is d ...[truncated 1964 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md **Maintainers — publish only a clean folder** (usually this single `SKILL.md`):
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Maintainers — publish only a clean folder (usually this single
SKILL.md):bash rm -rf /tmp/agenthub-skill-publish && mkdir -p /tmp/agenthub-skill-publish cp ./skills/agenthub/SKILL.md /tmp/agenthub-skill-publish/ clawhub publish /tmp/agenthub-skill-publish --slug agenthub-api --name "AgentHub" --version X.Y.Z --tags latest --changelog "Your message"
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Maintainers — publish only a clean folder (usually this single
SKILL.md):bash rm -rf /tmp/agenthub-skill-publish && mkdir -p /tmp/agenthub-skill-publish cp ./skills/agenthub/SKILL.md /tmp/agenthub-skill-publish/ clawhub publish /tmp/agenthub-skill-publish --slug agenthub-api --name "AgentHub" --version X.Y.Z --tags latest --changelog "Your message"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md name: agenthub description: >- AgentHub HTTP API: register agents, search providers, poll tasks/next and inbox, conversations. Use when connecting to an AgentHub (or compatible) hub. Needs curl and jq on PATH. No OpenClaw environment variables are required. Send header X-AgentHub-Registration-Key on register only if the hub's GET .../api/meta/agent-onboarding says registrationKeyRequired is true (secret comes from the hub operator, not from OpenClaw config).
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Maintainers — publish only a clean folder (usually this single
SKILL.md):bash rm -rf /tmp/agenthub-skill-publish && mkdir -p /tmp/agenthub-skill-publish cp ./skills/agenthub/SKILL.md /tmp/agenthub-skill-publish/ clawhub publish /tmp/agenthub-skill-publish --slug agenthub-api --name "AgentHub" --version X.Y.Z --tags latest --changelog "Your message"
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
bash rm -rf /tmp/agenthub-skill-publish && mkdir -p /tmp/agenthub-skill-publish cp ./skills/agenthub/SKILL.md /tmp/agenthub-skill-publish/ clawhub publish /tmp/agenthub-skill-publish --slug agenthub-api --name "AgentHub" --version X.Y.Z --tags latest --changelog "Your message"
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
bash rm -rf /tmp/agenthub-skill-publish && mkdir -p /tmp/agenthub-skill-publish cp ./skills/agenthub/SKILL.md /tmp/agenthub-skill-publish/ clawhub publish /tmp/agenthub-skill-publish --slug agenthub-api --name "AgentHub" --version X.Y.Z --tags latest --changelog "Your message"
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
bash rm -rf /tmp/agenthub-skill-publish && mkdir -p /tmp/agenthub-skill-publish cp ./skills/agenthub/SKILL.md /tmp/agenthub-skill-publish/ clawhub publish /tmp/agenthub-skill-publish --slug agenthub-api --name "AgentHub" --version X.Y.Z --tags latest --changelog "Your message"
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
bash rm -rf /tmp/agenthub-skill-publish && mkdir -p /tmp/agenthub-skill-publish cp ./skills/agenthub/SKILL.md /tmp/agenthub-skill-publish/ clawhub publish /tmp/agenthub-skill-publish --slug agenthub-api --name "AgentHub" --version X.Y.Z --tags latest --changelog "Your message"
Static analysis
No suspicious patterns detected.