A2A Delegation Setup

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 9:13 AM UTC
• Version: 0.1.0

Overview

This skill is a clear setup guide for installing and configuring an OpenClaw delegation plugin, with the main risk being normal third-party plugin trust.

Before installing, confirm that you trust the @aramisfa/openclaw-a2a-outbound package, prefer a reviewed pinned version, test updates before production use, and run the Gateway with least privilege because enabling the plugin changes persistent OpenClaw behavior.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:55
• Finding: Unreviewed Third-Party Plugin Installation and Update## Vulnerability Details **File Location**: `SKILL.md`, lines 55-64 **Vulnerability Type**: Third-party software supply-chain exposure **Risk Level**: Medium The skill directs the user or agent to install or update executable third-party plugin code that is not included in this project and therefore could not be reviewed as part of this audit. ```bash openclaw plugins install @aramisfa/openclaw-a2a-outbound --pin ``` For an update: ```bash openclaw plugins update openclaw-a2a-outbound ``` Then ensure the plugin entry itself is enabled: ```bash openclaw plugins enable openclaw-a2a-outbound ``` ### Technical Analysis These commands retrieve, install, update, and enable the external `@aramisfa/openclaw-a2a-outbound` package. The external package's source and artifacts are absent from the audited project, so their integrity and runtime behavior cannot be established from `SKILL.md`. The `--pin` option may improve version reproducibility, but the instructions do not require an audited exact version, cryptographic integrity verification, trusted artifact provenance, or review of the resolved package and transitive dependencies. The update command may also retrieve a release published after this skill was reviewed. This creates a supply-chain trust boundary: compromise of the package, publisher account, registry, distribution infrastructure, or a transitive dependency could result in attacker-controlled code being installed and enabled on the OpenClaw Gateway. ### Attack Path 1. An attacker compromises the package publisher, package registry, release pipeline, or an included dependency. 2. The attacker publishes a malicious version or replaces an expected artifact. 3. A user approves the installation or update as required by the skill's interaction rules. 4. The agent or user runs the documented `openclaw plugins install` or `openclaw plugins update` command. 5. OpenClaw retrieves the compromised artifact. ...[truncated 927 chars]
• Remediation: ## Remediation Suggestions 1. Pin installation to an exact, reviewed package version rather than relying only on a general `--pin` workflow. 2. Verify package integrity using a trusted cryptographic digest or signed provenance before installation. 3. Retrieve packages exclusively from an explicitly configured and trusted registry. 4. Audit the plugin source, release artifact, installation hooks, and transitive dependencies before deployment. 5. Require manual security review and approval before every update; do not update automatically to an unreviewed release. 6. Record the approved version and integrity digest in the skill instructions so operators can verify the resolved artifact. 7. Run the OpenClaw Gateway under a dedicated least-privileged account and restrict filesystem, network, secret, and configuration access to the minimum required. 8. Test new versions in an isolated environment before enabling them on a production Gateway. 9. Provide a documented rollback procedure and retain the last verified artifact and configuration.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match

Content

---
name: a2a-delegation-setup
description: Guided setup and troubleshooting for installing, enabling, configuring, verifying, and updating @aramisfa/openclaw-a2a-outbound in OpenClaw.
homepage: "https://github.com/aramisfacchinetti/openclaw-a2a-plugins/tree/master/packages/openclaw-a2a-outbound#readme"
user-invocable: true
disable-model-invocation: true
---

# A2A Delegation Setup

Use this skill when `@aramisfa/openclaw-a2a-outbound` still needs installation, enablement, configuration, verification, updating, or troubleshooting on the OpenClaw Gateway host.

Do not use this skill for routine runtime delegation after setup is complete. Once the plugin is ready, switch to the bundled `remote-agent` skill and the `remote_agent` tool.

## Interaction rules

- Ask before any install, update, restart, or config edit.
- Run commands on the Gateway host that owns the OpenClaw config and plugin installation.
- If shell access i

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

openclaw config validate
```

Replace the example alias, base URL, default-target choice, and URL-override policy with the values you confirmed earlier.

## Activate and verify

• Confidence: 90% confidence
• Finding: Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Static analysis

No suspicious patterns detected.