T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/a2a_client.py:208- Finding
Unverified Remote Skill Content Is Retrieved and Intended for Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
A2A Market
Security checks for vulnerabilities and agentic risk
Overview
This marketplace skill is not plainly malicious, but it should go to Review because it can spend credits or USDC, publish skill content, and install third-party skills without strong enough safeguards.
Review before installing. Use this only if you trust the A2A Market service and are comfortable with wallet signing, account identifiers, remote skill acquisition, and skill-content publication. Disable auto-buy and auto-list behavior, require explicit confirmation for every purchase, reward claim, registration, listing, and installation, verify any acquired package before activation, protect the stored agent ID, and avoid the public GitHub or unpinned global install shortcuts unless you have reviewed the files being uploaded or installed.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (6)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/a2a_client.py:382- Finding
Credit Purchases Bypass Budget, Reputation, and Confirmation Controls
- Content
View full analysis
Dict[str, Any]: """ Purchase a skill using credits instead of USDC. Args: skill_id: ID of the skill to purchase Returns: Skill content and payment details """ headers = self._agent_headers() headers["Content-Type"] = "application/json" response = requests.post( f"{self.api_url}/v1/listings/{skill_id}/pay", headers=headers, data=json.dumps({"payment_method": "credits"}) ) response.raise_for_status() return response.json() ``` ### Technical Analysis The credit-payment branch returns before fetching listing metadata or invoking seller-reputation, transaction-limit, daily-budget, and human-confirmation checks. It also does ...[truncated 1190 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/a2a_client.py:452- Finding
Automatic Listing Can Publish Skill Content Without Required Owner Approval
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/a2a_client.py:31- Finding
Unrestricted API Endpoint Override Can Redirect Sensitive Marketplace Traffic
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/a2a_client.py:328- Finding
Agent Authorization Identifier Is Persisted Without Explicit Restrictive Permissions
- Content
View full analysis
"$AGENT_ID_FILE" echo "$referral_code" > "$REFERRAL_CODE_FILE" ``` ### Technical Analysis The code relies on the process umask to determine permissions for files under the user's home directory. It does not explicitly create them with mode `0600`, verify ownership, reject symbolic links, or atomically replace existing files. The agent ID is placed directly in the `x-agent-id` header for balance, reward, and credit-purchase operations. Based on the documented API, no additional wallet signature is applied to those operations, so the identifier functions as authorization material rather than merely public metadata. ### Attack Path 1. The client runs under a permissive umask or writes through a pre-existing unsafe path. 2. The resulting agent-ID file is readable by another local user, or a symlink redirects the write. 3. The attacker reads or captures the agent ID. 4. The attacker sends it in the `x-agent-id` header to credit endpoints. 5. Subject to server behavior, the attacker checks balances, claims rewards, or spends credits. ### Impact Assessment The likely scope is the marketplace credit account associated with the stored agent ID. It does not directly expose the wallet private key. On a shared system, however, unauthorized credit spending and account activity may be possible if possession of the agent ID is sufficient authentication. ]]>- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
publish.sh:45- Finding
Publishing Workflow Installs an Unpinned Global npm Package
- Content
View full analysis
/dev/null; then echo -e "${GREEN}✓ clawhub CLI is installed${NC}" clawhub --version 2>/dev/null || true else echo -e "${YELLOW}Installing clawhub CLI...${NC}" npm install -g clawhub echo -e "${GREEN}✓ clawhub CLI installed${NC}" fi ``` The quick-start documentation similarly recommends: ```bash npm install -g clawhub && \ clawhub login && \ cd a2a-market-skill && \ clawhub publish . \ ``` ### Technical Analysis The workflow installs the latest available `clawhub` package globally without pinning a reviewed version or integrity digest. npm installation can execute package lifecycle scripts. A future compromised release, registry compromise, account takeover, or unexpected breaking update would therefore execute code on the publisher's system. Global installation also broadens the effect beyond this project and may run with elevated privileges depending on the user's npm configuration. ### Attack Path 1. The npm package or publisher account is compromised, or a malicious release is published. 2. A user runs `publish.sh` or copies the documented quick command. 3. npm resolves the current latest package rather than a reviewed version. 4. Package installation or lifecycle code executes locally. 5. The installed CLI can access the user's environment and later receives GitHub authentication and project publication access. ### Impact Assessment A malicious dependency could execute with the privileges of the publishing user, access project files and environment variables, modify globally installed tooling, and target GitHub or ClawHub authentication established immediately afterward. The audited files do not prove that the current `clawhub` package is malicious ...[truncated 77 chars]- Remediation
View remediation
`. 2. Verify npm provenance and the expected package integrity before execution. 3. Record dependencies in a lockfile and use a reproducible installation command. 4. Prefer a project-local, isolated installation rather than `npm install -g`. 5. Disable lifecycle scripts where compatible, or review every required lifecycle script. 6. Avoid installing and immediately granting authentication to an unverified latest release. 7. Document the expected publisher, package version, checksum, and verification procedure. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (38)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The GitHub fallback commands create a public repository and push local contents, yet the document does not warn that this will expose files publicly on GitHub. In a marketplace skill context, operators may be handling API keys, wallet config, unpublished agent logic, or other sensitive artifacts, making accidental disclosure materially more dangerous.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description says this skill enables agent-facing marketplace operations: finding, buying, selling, monetizing skills, and handling credits/rewards/referrals/payments. The actual code chunk does none of that. It is an auxiliary developer release script whose primary purpose is to publish the skill package to ClawHub from a local machine. While publishing infrastructure can support distribution, it is materially different from the declared runtime marketplace integration and lacks any implementation of the advertised marketplace, payment, credits, or earnings features.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The description claims a broad marketplace integration that enables autonomous buying and selling of skills and supports x402 USDC payments on Base L2 plus credits. The supplied code is much narrower: it provides CLI commands for registration, credits balance, daily reward claiming, referral display, marketplace search, listing info lookup, price suggestion, earnings lookup, and API health checks. Those functions do align with parts of the description around search, earnings, credits, daily rewards, referrals, and registration. However, the core declared capabilities of buying skills, selling/listing skills, and payment support are absent. There are no commands or API calls for creating listings, purchasing listings, initiating payments, or handling x402/USDC/Base L2 flows. Because the primary marketplace-action capabilities are missing and payment support is overstated, this is a material description-behavior mismatch.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly permits autonomous purchases, reward claims, and capability-acquisition actions, some triggered by internal conditions like task failure or low efficiency rather than clear user authorization. In a financial/account-management context, this creates a real risk of unauthorized spending, unwanted account actions, and abuse if prompts or environmental conditions manipulate the agent into self-initiated transactions.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 96% confidence
- Finding
The presence of a direct DELETE /v1/listings/:id endpoint creates a high-risk tool surface because an agent with signing capability could be induced to perform irreversible marketplace actions on behalf of the user. Within this skill's context—buying, selling, and monetizing skills autonomously—tool parameter abuse is especially dangerous because a malformed, attacker-supplied, or misresolved listing ID could remove an active product and disrupt income.
- Content
Delete Listing
text DELETE /v1/listings/:id Response: 204 No Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
bash # 使用 GitHub CLI gh repo create a2a-market-skill --public --description "A2A Market skill for OpenClaw - Where agents earn" # 或者手动在 github.com 创建
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The one-click publish command uploads the current skill directory to a remote marketplace, but the documentation gives no warning that local contents will be sent off-host. Users may run the command blindly and unintentionally publish secrets, internal files, or unfinished code because it is presented as copy-paste ready.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 65% confidence
- Finding
uvx/uv tool run commands without ==version create a rug-pull risk.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 65% confidence
- Finding
uvx/uv tool run commands without ==version create a rug-pull risk.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill documents network access, local file storage, environment-variable use, and payment-related operations but declares no explicit tool scope or permission boundaries. In an agent marketplace context, missing scope constraints increases the chance that the runtime grants broader capabilities than users expect, enabling unintended external calls, local persistence, or secret access during automated flows.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases are broad enough to invoke a high-risk marketplace/payment skill from casual mentions like 'marketplace' or references to earning money. In this context, overbroad routing is dangerous because it can activate workflows that search external services, register accounts, claim rewards, or initiate purchases when the user did not intend financial or account actions.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 96% confidence
- Finding
The configuration explicitly authorizes auto-buying below a threshold, enabling the agent to spend funds without a contemporaneous human decision. In a marketplace connected to a wallet and private key, even low-dollar autonomous purchases can be abused repeatedly, chained into budget exhaustion, or redirected toward malicious listings.
- Content
md max_per_transaction: 10.00 # Max $10 per purchase daily_budget: 100.00 # Max $100/day min_seller_reputation: 60 # Only buy from rep >= 60 auto_approve_below: 5.00 # Auto-buy under $5 require_confirmation_above: 50.00 # Selling rules
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # Search by keyword curl "https://api.a2amarket.live/v1/listings/search?q=data_analysis" # With filters curl "https://api.a2amarket.live/v1/listings/search?q=code_review&min_rep=70&max_price=15"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # Search by keyword curl "https://api.a2amarket.live/v1/listings/search?q=data_analysis" # With filters curl "https://api.a2amarket.live/v1/listings/search?q=code_review&min_rep=70&max_price=15"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # Search by keyword curl "https://api.a2amarket.live/v1/listings/search?q=data_analysis" # With filters curl "https://api.a2amarket.live/v1/listings/search?q=code_review&min_rep=70&max_price=15"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # Search by keyword curl "https://api.a2amarket.live/v1/listings/search?q=data_analysis" # With filters curl "https://api.a2amarket.live/v1/listings/search?q=code_review&min_rep=70&max_price=15"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # Search by keyword curl "https://api.a2amarket.live/v1/listings/search?q=data_analysis" # With filters curl "https://api.a2amarket.live/v1/listings/search?q=code_review&min_rep=70&max_price=15"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # Search by keyword curl "https://api.a2amarket.live/v1/listings/search?q=data_analysis" # With filters curl "https://api.a2amarket.live/v1/listings/search?q=code_review&min_rep=70&max_price=15"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # Search by keyword curl "https://api.a2amarket.live/v1/listings/search?q=data_analysis" # With filters curl "https://api.a2amarket.live/v1/listings/search?q=code_review&min_rep=70&max_price=15"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 83% confidence
- Finding
Requesting paid content from the remote service is an expected part of the workflow, but in this context it is coupled to an automated payment flow and content acquisition from an external marketplace. The danger is not the GET itself; it is that this network step is part of a pipeline that can progress toward financial commitment and retrieval of untrusted skill content.
- Content
- Request skill content → receive HTTP 402:
bash curl -i "https://api.a2amarket.live/v1/listings/skill_042/content" # Returns: 402 Payment Required # Header: X-Payment-Required: {"amount": "8000000", "recipient": "0xSeller..."}
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 98% confidence
- Finding
This step sends signed payment proof to an external API as part of a purchase flow, enabling real financial transfers tied to the agent's wallet. In combination with autonomous buying and local private-key usage described elsewhere, this is highly dangerous because prompt manipulation or misrouting could cause unauthorized payments to attacker-controlled listings.
- Content
- Sign USDC transfer and retry with payment proof:
bash curl -X POST "https://api.a2amarket.live/v1/listings/skill_042/content" \ -H "X-Payment: <signed_payment_proof>"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 86% confidence
- Finding
Posting a listing transmits monetization details and publishes the seller's offering to a third-party marketplace. In this skill's context, that can expose proprietary capability descriptions or create unwanted public listings if initiated without clear user consent, especially because the skill contemplates autonomous sell-side behavior.
- Content
List a Skill for Sale
bash curl -X POST "https://api.a2amarket.live/v1/listings" \ -H "Content-Type: application/json" \ -d '{ "name": "Research Assistant",
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
Agent registration sends wallet and agent identity data to an external service and establishes an account relationship that can later be used for credits, referrals, and automated actions. In this context, automatic registration without explicit consent could create unwanted third-party accounts and link persistent identifiers to the user or agent.
- Content
Register to get an agent ID, referral code, and initial credits:
bash curl -X POST "https://api.a2amarket.live/v1/agents/register" \ -H "Content-Type: application/json" \ -d '{"wallet_address": "0xYourWallet...", "name": "My Agent"}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
Claiming a daily reward is an account-affecting write action to an external service. Although not a monetary debit, it changes account state and, combined with autonomous behavior guidance, could perform unintended actions on behalf of the user without clear consent.
- Content
-H "x-agent-id: agent_abc123"
Claim reward
curl -X POST "https://api.a2amarket.live/v1/rewards/daily/claim"
-H "x-agent-id: agent_abc123"text
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
This endpoint executes a purchase using credits, which are a spendable account resource, against an external marketplace. Given the skill's autonomous purchase language and broad triggers, this creates a substantial risk of unauthorized or manipulated spending even without direct blockchain signing.
- Content
Pay for skills using credits instead of USDC:
bash curl -X POST "https://api.a2amarket.live/v1/listings/skill_042/pay" \ -H "Content-Type: application/json" \ -H "x-agent-id: agent_abc123" \ -d '{"payment_method": "credits"}'
Static analysis
No suspicious patterns detected.