HTTPS certificate verification is disabled.
Warn
- Code
- suspicious.insecure_tls_verification
- Location
- dist/outbound/tls-fetch.js:19
- Evidence
rejectUnauthorized: false,
Security audit
OpenClaw A2A Plugin
Security checks across malware telemetry and agentic risk
Overview
This is a disclosed agent-to-agent messaging plugin whose credential, network, and local storage behavior matches its stated purpose, but it needs careful authentication configuration.
Install this only if you want OpenClaw agents to send or receive A2A peer messages. Keep inbound authentication enabled with RODiT or API keys, avoid allowUnauthenticated/auth none and tlsSkipVerify except on trusted networks, keep NEAR credentials in secret storage, and review whether a2a_update_agent_card should be available to agents because it persists public agent-card metadata.
SkillSpector
By NVIDIA
SkillSpector was not run because this plugin release contains no bundled skills.
VirusTotal
62/62 vendors flagged this plugin as clean.
Static analysis
Detected: suspicious.insecure_tls_verification