protocol bridge

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:36 AM UTC
• Version: 1.0.0

Overview

This appears to be a legitimate agent protocol bridge, but it needs review because it asks users to install an unpinned global npm tool and run a network bridge without enough scoping or data-handling warnings.

Review the npm package source and provenance before installing, prefer a pinned local install where possible, avoid running it as administrator/root, bind the server to localhost unless intentionally exposing it, and only route data to trusted agents and endpoints with appropriate authentication configured.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: skill.md:25

Finding

Unpinned Global Installation of an Unverifiable Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: skill.md:22-26, skill.md:159-163, readme.md:22-28, and readme.md:52-58
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code

The English installation instructions in skill.md contain:

bash

npm install -g openclaw-protocol-bridge

The same command is repeated in the Chinese installation section:

bash

npm install -g openclaw-protocol-bridge

The English quick-start instructions in readme.md contain:

bash

npm install -g openclaw-protocol-bridge
protocol-bridge init
protocol-bridge serve --port 8080

The same quick-start sequence is repeated in the Chinese section:

bash

npm install -g openclaw-protocol-bridge
protocol-bridge init
protocol-bridge serve --port 8080

Technical Analysis

The documented command globally installs the latest version of openclaw-protocol-bridge from the npm registry. It does not pin a reviewed version, verify a cryptographic integrity value, use a lockfile, or provide auditable package source within this project.

npm packages can define lifecycle scripts that execute during installation. Consequently, the effective code executed by this instruction can change after the Skill has been reviewed. Global installation increases the potential scope because the package and its command-line executables are placed in the user's global Node.js environment. If the command is run with elevated privileges, installation scripts receive those elevated privileges; the instruction itself, however, does not explicitly request privilege escalation.

The artifact contains only documentation and does not include a package manifest, lockfile, implementation, checksums, or tests. Therefore, the external package's behavior and the documented security claims concerning JWT, OAuth, API keys, and mTLS cannot be verified from the audited project.

A

...[truncated 1675 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a specifically reviewed version:

   bash

   npm install -g openclaw-protocol-bridge@1.0.0
   

2. Prefer a project-local installation instead of a global installation:

   bash

   npm install --save-exact openclaw-protocol-bridge@1.0.0
   

3. Commit a package.json and lockfile so dependency versions and integrity metadata are reproducible.

4. Review the package's source, transitive dependencies, and lifecycle scripts before recommending installation.

5. Where compatible with the package, suppress lifecycle scripts during initial acquisition:

   bash

   npm install --save-exact --ignore-scripts openclaw-protocol-bridge@1.0.0
   

6. Publish cryptographic checksums, package provenance, and release-signing information through a trusted channel.

7. Avoid running npm installation commands as root or an administrator. Run the bridge under a dedicated, least-privileged account with restricted filesystem and network access.

8. Include the relevant implementation or verifiable source revision in the audited artifact so that the bridge's authentication, routing, registration, and network behavior can be assessed directly.

9. Apply the corrected, pinned installation command consistently to both language sections of skill.md and readme.md.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill describes a cross-protocol bridge that forwards messages between agents and endpoints, but it does not warn users that prompts, tool outputs, credentials, or other sensitive data may be relayed across trust boundaries. In an agent-integration context, this omission is security-relevant because users may assume protocol translation is purely mechanical while the bridge can expand exposure to additional services, networks, and potentially less-trusted agents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The README quick-start instructs users to run protocol-bridge serve --port 8080, which starts a listening network service, but it does not warn that this exposes a port or clarify whether it binds only to localhost or all interfaces. In an agent/integration tool that bridges multiple protocols, accidental exposure could make the service reachable by other local network users or external systems depending on defaults, increasing the attack surface.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.