A2A Delegation Setup

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 9:13 AM UTC
• Version: 0.1.0

Overview

This skill is a clear setup guide for installing and configuring an OpenClaw delegation plugin, with the main risk being normal third-party plugin trust.

Before installing, confirm that you trust the @aramisfa/openclaw-a2a-outbound package, prefer a reviewed pinned version, test updates before production use, and run the Gateway with least privilege because enabling the plugin changes persistent OpenClaw behavior.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:55

Finding

Unreviewed Third-Party Plugin Installation and Update

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 55-64
Vulnerability Type: Third-party software supply-chain exposure
Risk Level: Medium

The skill directs the user or agent to install or update executable third-party plugin code that is not included in this project and therefore could not be reviewed as part of this audit.

bash

openclaw plugins install @aramisfa/openclaw-a2a-outbound --pin

For an update:

bash

openclaw plugins update openclaw-a2a-outbound

Then ensure the plugin entry itself is enabled:

bash

openclaw plugins enable openclaw-a2a-outbound

Technical Analysis

These commands retrieve, install, update, and enable the external @aramisfa/openclaw-a2a-outbound package. The external package's source and artifacts are absent from the audited project, so their integrity and runtime behavior cannot be established from SKILL.md.

The --pin option may improve version reproducibility, but the instructions do not require an audited exact version, cryptographic integrity verification, trusted artifact provenance, or review of the resolved package and transitive dependencies. The update command may also retrieve a release published after this skill was reviewed.

This creates a supply-chain trust boundary: compromise of the package, publisher account, registry, distribution infrastructure, or a transitive dependency could result in attacker-controlled code being installed and enabled on the OpenClaw Gateway.

Attack Path

1. An attacker compromises the package publisher, package registry, release pipeline, or an included dependency.
2. The attacker publishes a malicious version or replaces an expected artifact.
3. A user approves the installation or update as required by the skill's interaction rules.
4. The agent or user runs the documented openclaw plugins install or openclaw plugins update command.
5. OpenClaw retrieves the compromised artifact.

...[truncated 927 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin installation to an exact, reviewed package version rather than relying only on a general --pin workflow.
2. Verify package integrity using a trusted cryptographic digest or signed provenance before installation.
3. Retrieve packages exclusively from an explicitly configured and trusted registry.
4. Audit the plugin source, release artifact, installation hooks, and transitive dependencies before deployment.
5. Require manual security review and approval before every update; do not update automatically to an unreviewed release.
6. Record the approved version and integrity digest in the skill instructions so operators can verify the resolved artifact.
7. Run the OpenClaw Gateway under a dedicated least-privileged account and restrict filesystem, network, secret, and configuration access to the minimum required.
8. Test new versions in an isolated environment before enabling them on a production Gateway.
9. Provide a documented rollback procedure and retain the last verified artifact and configuration.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 6)May include surrounding context.

md

---
name: a2a-delegation-setup
description: Guided setup and troubleshooting for installing, enabling, configuring, verifying, and updating @aramisfa/openclaw-a2a-outbound in OpenClaw.
homepage: "https://github.com/aramisfacchinetti/openclaw-a2a-plugins/tree/master/packages/openclaw-a2a-outbound#readme"
user-invocable: true
disable-model-invocation: true
---

# A2A Delegation Setup

Use this skill when `@aramisfa/openclaw-a2a-outbound` still needs installation, enablement, configuration, verification, updating, or troubleshooting on the OpenClaw Gateway host.

Do not use this skill for routine runtime delegation after setup is complete. Once the plugin is ready, switch to the bundled `remote-agent` skill and the `remote_agent` tool.

## Interaction rules

- Ask before any install, update, restart, or config edit.
- Run commands on the Gateway host that owns the OpenClaw config and plugin installation.
- If shell access i

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 90% confidence

Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

openclaw config validate

text

Replace the example alias, base URL, default-target choice, and URL-override policy with the values you confirmed earlier.

## Activate and verify

Static analysis

No suspicious patterns detected.