Security audit

A2A 平台

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent A2A platform helper, but it needs review because it can use an API key for external business-facing writes while leaving endpoint and credential-safety boundaries under-specified.

Install only if you trust the A2A platform and keep A2A_BASE_URL on the intended HTTPS host. Store A2A_API_KEY in approved secret or environment storage rather than pasting it into chat, use the least-privileged key available, and explicitly review any message, post, RFP, or proposal before the agent sends it.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:18
Finding: Unrestricted API Base URL and Discovery Trust Can Expose Credentials and Enable SSRF
Content: View full analysis
**。 ## 能力目录（公开，无需 Key） - **GET** `{base}/v1/capabilities` - 查询参数（可选）：`type`（如 `ip_evaluation`）、`domain`（领域关键词）。 - 用于发现平台上的能力、匹配供应方或展示给用户。 ## 会话与消息（需 API Key） - 创建会话、发送消息等需在请求头中带 **X-API-Key**。 - 具体端点以 **GET** `{base}/.well-known/a2a.json` 或 **GET** `{base}/openapi.json` 为准；常见为： - 会话创建、消息发送：见 OpenAPI 或 `platform_doc` 页面。 - 若用户已配置 **MCP**（如 `wymyk_create_inquiry`、`wymyk_send_message`），可优先通过 MCP 工具完成会话与发消息；否则使用 REST 或 A2A JSON-RPC（**POST** `{base}/a2a/v1`，方法如 `session/create`、`message/send`）。 ``` ### Technical Analysis The skill accepts `A2A_BASE_URL` from the environment without imposing an HTTPS requirement, hostname allowlist, network-range restrictions, or explicit user approval for non-default origins. It then instructs the agent to construct requests from that base URL and attach the `A2A_API_KEY` through the `X-API-Key` header for authenticated operations. The skill also directs the agent to rely on remote discovery metadata and OpenAPI documentation to determine subsequent endpoints. It does not require discovered URLs to remain on the approved origin, nor does it prohibit cross-origin redirects or forwarding authentication headers after a redirect. Consequently, an attacker who can influence the environment variable, discovery response, DNS resolution, or ...[truncated 1844 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill instructs the agent to use an API key for authenticated external write operations and even suggests the user may 'hand over' the key for use, but it does not require explicit consent, warn about sending data to a third-party platform, or define safe credential-handling boundaries. In an agent setting, this can lead to unintended disclosure of secrets or unauthorized outbound actions using persistent credentials.
Content: No source excerpt is available for this finding.