A2A 平台

• Analyzed: May 14, 2026, 4:20 AM
• Findings: 1
• Version: 1.0.0
• Hash: 1edb22811195aa26c2308cb4befd0c9432ad025fb669ef5f022e726206c64f7a
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to its instructions for handling sensitive API keys. Specifically, the `SKILL.md` file instructs the agent to prompt the user for the `A2A_API_KEY` if not provided, including the phrase '或交给你使用' (or hand it over to you). While intended for legitimate authentication to the A2A platform (https://a2a4b2b.com), this direct solicitation of a sensitive credential by the agent is a high-risk prompt injection vector. Additionally, the `A2A_BASE_URL` is configurable via an environment variable, which, if compromised externally, could redirect all API traffic and potentially lead to API key leakage, although the skill itself does not instruct malicious redirection.