A2A Agent Board: Publish · Find · Use with itinai.com

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:09 AM UTC
• Version: 1.0.4

Overview

The skill is mostly coherent, but it needs Review because it can fetch or post to user-controlled HTTPS endpoints and its example install path runs an unpinned npm package.

Install only if you are comfortable with an MCP server that contacts external Agent Card and runtime URLs. Prefer a pinned package version or local locked install, and avoid using it in environments where localhost or private HTTPS services are reachable unless destination allowlists or private-network blocking are added.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: src/index.ts:65

Finding

Arbitrary HTTPS Requests Enable Server-Side Request Forgery

Content

View full analysis

{ const url = agent_card_url || config.agentCardUrl; const card = await fetchJson(url, "GET"); return jsonToolResult(card); } ``` ```ts const endpoint = endpoint_url ? requireHttpsUrl(endpoint_url, "endpoint_url") : await getRuntimeEndpointFromAgentCard(agent_card_url); const outboundPayload = payload || buildServiceRequestPayload(service_request); assertPayloadHasNoObviousSecrets(outboundPayload); ``` ```ts async function getRuntimeEndpointFromAgentCard(agentCardUrl?: string): Promise { if (!agentCardUrl) { throw new Error("agent_card_url or endpoint_url is required for service requests."); } const card = await fetchJson(agentCardUrl, "GET"); const endpoint = extractRuntimeEndpoint(card); if (!endpoint) { throw new Error("Agent Card does not expose a usable HTTPS runtime endpoint in url, endpoints.a2a, endpoints.tasks, or endpoints.message."); } return endpoint; } function extractRuntimeEndpoint(card: unknown): string { if (!isObject(card)) { return ""; } const candidates: unknown[] = [card.url]; if (isObject(card.endpoints)) { candidates.push(card.endpoints.a2a, card.endpoints.tasks, card.endpoints.message, card.endpoints.rpc, card.endpoints.jsonrpc); } for (const candidate of candidates) { const endpoint = trimString(candidate); if (endpoint && endpoint.startsWith("https://")) { return requireHt ...[truncated 3216 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: examples/claude_desktop_config.json:4

Finding

Unpinned Packages Are Downloaded and Executed

Content

View full analysis

clawhub skill publish . --slug a2a-agent-discovery --name "A2A Agent Discovery" --version 1.0.2 --tags latest,agent-discovery,a2a,find-agents,agent-registry,multi-agent,delegation,itinai,agent-card --changelog "Tighten instructions, source boundaries, confirmation gates, and endpoint validation" ``` ### Technical Analysis The example MCP configuration uses `npx -y itinai-a2a-catalog-mcp` without an exact version. This allows the package registry's currently selected version to be downloaded and executed automatically when the MCP server starts. The publishing workflow similarly installs the latest available `clawhub` package globally. The repository's `package-lock.json` does not constrain either of these on-demand or global installations. The installed CLI is subsequently invoked with `CLAWHUB_TOKEN`, making integrity of that package security-sensitive. This is not evidence that the current packages are malicious. The vulnerability is that reviewed code and lockfile state do not determine the code that will execute in future runs. ### Attack Path #### MCP client path 1. An attacker compromis ...[truncated 1476 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Known Vulnerable Dependency: fast-uri==3.1.2 — 6 advisory(ies): CVE-2026-13676 (fast-uri vulnerable to host confusion via failed IDN canonicalization); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +3 more

High

• Category: Supply Chain
• Confidence: 88% confidence

Finding

fast-uri 3.1.2 is reported with multiple URI parsing flaws that can enable host confusion or SSRF-bypass behavior. In an agent-discovery and A2A request skill, URL parsing and outbound service selection are likely security-sensitive, so a flawed URI parser in the stack materially increases risk if any user-controlled URLs, hosts, or callback targets are handled.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: hono==4.12.23 — 15 advisory(ies): CVE-2026-71848 (Hono: Algorithmic Complexity DoS in Language Middleware); CVE-2026-71849 (Hono: Proxy Helper does not remove response headers listed in the `Connection` h); CVE-2026-54290 (hono: CORS Middleware reflects any Origin with credentials when `origin` default) +12 more

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

hono 4.12.23 is flagged with numerous advisories affecting middleware and helper behavior, including CORS, proxy, and DoS-related issues. Because this skill appears network-facing and intended to discover agents and make reviewed service requests, vulnerabilities in the HTTP framework can directly affect request handling, access control, and service availability.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ip-address==10.2.0 — 3 advisory(ies): CVE-2026-54272 (ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSR); CVE-2026-69198 (ip-address: a CIDR suffix on the parsed address suppresses special-use classific); CVE-2026-69192 (ip-address: Address4 decodes leading-zero octets as decimal while resolvers deco)

High

• Category: Supply Chain
• Confidence: 87% confidence

Finding

ip-address 10.2.0 is flagged for parsing and classification issues that can undermine SSRF protections and special-address filtering. In an agent discovery/service request context, misclassifying private, NAT64, or IPv4-mapped IPv6 targets could let an attacker steer requests toward internal infrastructure despite apparent validation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill explicitly directs network access to external registries and remote agent endpoints, and its metadata declares executable capabilities (node, npx), but it does not define any explicit tool scope such as permissions or allowed-tools. That leaves the runtime with broader-than-necessary access to network, shell, and potentially environment data, increasing the risk of unintended outbound requests, SSRF-style abuse, or leakage if the skill is invoked in an overprivileged agent context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The description text is written in Russian with no indication that the skill supports other languages or that the locale is intentionally restricted. The policy calls for flagging language or locale constraints when they are imposed without user opt-in or documented justification.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: @hono/node-server==1.19.14 — 1 advisory(ies): GHSA-frvp-7c67-39w9 (Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encode)

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The lockfile pins @hono/node-server 1.19.14, which is reported as affected by a Windows-specific path traversal issue in static file serving. Even though this package is only a transitive dependency here, shipping a known vulnerable version is still a real supply-chain risk if the skill exposes HTTP functionality using the affected adapter on Windows.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: body-parser==2.2.2 — 1 advisory(ies): CVE-2026-12590 (body-parser vulnerable to denial of service when invalid limit value silently di)

Low

• Category: Supply Chain
• Confidence: 76% confidence

Finding

body-parser 2.2.2 is flagged for a denial-of-service condition tied to invalid limit handling. This is a genuine dependency risk, though its exploitability depends on whether the application uses body parsing on attacker-controlled requests with misconfigured limits.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: esbuild==0.28.0 — 1 advisory(ies): GHSA-g7r4-m6w7-qqqr (esbuild allows arbitrary file read when running the development server on Window)

Low

• Category: Supply Chain
• Confidence: 60% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: qs==6.15.2 — 2 advisory(ies): CVE-2026-82417 (qs: Denial of Service via Attacker Controlled isBuffer); CVE-2026-82562 (qs array-limit bypass via bracket-key comma parsing)

Low

• Category: Supply Chain
• Confidence: 74% confidence

Finding

qs 6.15.2 has reported denial-of-service and parser-limit bypass issues, which are relevant when parsing attacker-controlled query strings or form bodies. Since it is used transitively by express/body-parser in a likely HTTP-facing skill, this is a real but generally low-severity availability concern.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 28)May include surrounding context.

json

},
  "devDependencies": {
    "@types/node": "22.10.2",
    "tsx": "^4.22.4",
    "typescript": "5.7.2"
  },
  "engines": {

Static analysis

No suspicious patterns detected.