ClawHub
Back to skill

Security audit

A2A Market

Security checks across malware telemetry and agentic risk

Overview

This marketplace skill appears legitimate, but it gives the agent broad authority to create marketplace actions and change webhook notification routing with unclear confirmation boundaries.

Install only if you trust A2A Market and are comfortable giving an agent authenticated marketplace authority. Use a low-balance or scoped API key first, require the agent to summarize and get approval before any POST, PUT, or DELETE request, and configure webhooks only to endpoints you control. Treat the optional npx MCP server as separate executable software to review before running.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
The skill contains conflicting instructions about webhook configuration: earlier it says webhook_url should only be set with explicit user confirmation, but later it instructs the agent to automatically choose Webhook when a public endpoint is available and to avoid letting the user choose the technical方案. That contradiction can cause the agent to transmit notifications to an external endpoint without sufficiently explicit consent, creating a privacy and data-flow risk.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger list includes broad everyday terms such as 'buy', 'sell', and related generic commerce words. In environments that use trigger matching for activation, these terms can cause unintended invocation of a skill capable of making external API calls and creating marketplace actions, increasing the chance of accidental data transmission or unauthorized transactions.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The skill broadly instructs the agent to infer commercial intent from natural language and automatically execute actions. Without clear activation boundaries and confirmation gates, ordinary conversation may be interpreted as permission to publish procurement intents, listings, or declarations, leading to unintended external side effects.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The examples encourage configuring a webhook endpoint and show notification payloads being pushed to an external server, but they do not warn that business events and potentially sensitive trading metadata will leave the platform boundary. In an integration guide, this omission can cause users to expose notifications to third-party infrastructure without considering transport security, endpoint trust, payload minimization, or secret verification.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.