A2A Market

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:45 AM UTC
• Version: 1.1.0

Overview

This marketplace skill is not plainly malicious, but it should go to Review because it can spend credits or USDC, publish skill content, and install third-party skills without strong enough safeguards.

Review before installing. Use this only if you trust the A2A Market service and are comfortable with wallet signing, account identifiers, remote skill acquisition, and skill-content publication. Disable auto-buy and auto-list behavior, require explicit confirmation for every purchase, reward claim, registration, listing, and installation, verify any acquired package before activation, protect the stored agent ID, and avoid the public GitHub or unpinned global install shortcuts unless you have reviewed the files being uploaded or installed.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (6)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/a2a_client.py:208
• Finding: Unverified Remote Skill Content Is Retrieved and Intended for Installation<![CDATA[ ## Vulnerability Details **File Location**: `scripts/a2a_client.py:208-234`; related installation workflow at `SKILL.md:280-291` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```python # Step 1: Request content, expect 402 response = requests.get(f"{self.api_url}/v1/listings/{skill_id}/content") if response.status_code != 402: if response.status_code == 200: # Already purchased or free return response.json() response.raise_for_status() # Step 2: Parse payment requirements payment_info = json.loads(response.headers.get("X-Payment-Required", "{}")) # Step 3: Sign payment (simplified - real implementation uses ERC-3009) payment_proof = self._sign_payment(payment_info, price) # Step 4: Retry with payment proof headers = self._sign_request("POST", f"/v1/listings/{skill_id}/content") headers["X-Payment"] = payment_proof headers["Content-Type"] = "application/json" response = requests.post( f"{self.api_url}/v1/listings/{skill_id}/content", headers=headers ) response.raise_for_status() # Update daily spent self.daily_spent += price return response.json() ``` The documented workflow subsequently directs the agent to install the result: ```text 5. Complete x402 payment flow 6. Install acquired skill 7. Confirm: "Purchased PDF Parser Pro for $5. Ready to use." ``` ### Technical Analysis The client retrieves mutable skill packages from an external marketplace and returns their instructions and files without verifying a publisher signature, immutable digest, trusted manifest, file allowlist, or expected package identity. The declared workflow then installs the acquired package. The remotely supplied content is controlled by marketplace sellers and can differ from anything reviewed with this project. Seller reputation and marketplace metadata are not substitutes for cryptographic integrity or package safety validation. A marketplace compromise could likewise r ...[truncated 1175 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require every package to include a publisher signature over an immutable manifest and content digest. 2. Verify the signature, publisher identity, package digest, listing ID, and package version locally before extraction or installation. 3. Pin the expected digest at purchase time so the marketplace cannot substitute content afterward. 4. Reject path traversal, symlinks, executable binaries, lifecycle hooks, and undeclared files during extraction. 5. Perform static scanning of scripts and instruction text before activation. 6. Display requested permissions and require explicit human approval before installing third-party content. 7. Install packages in an isolated directory and execute them in a sandbox with minimal filesystem, process, network, secret, and wallet access. 8. Maintain an auditable package receipt containing the seller, version, digest, signature, and approval record. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/a2a_client.py:382
• Finding: Credit Purchases Bypass Budget, Reputation, and Confirmation Controls<![CDATA[ ## Vulnerability Details **File Location**: `scripts/a2a_client.py:178-201` and `scripts/a2a_client.py:382-397` **Vulnerability Type**: Payment authorization control bypass **Risk Level**: High ### Vulnerable Code The generic purchase method immediately delegates credit payments before applying the checks used by the USDC path: ```python if payment_method == "credits": return self.purchase_with_credits(skill_id) # Get skill details first skill = self.get_skill(skill_id) price = skill["price"] # Check seller reputation seller_rep = skill.get("seller", {}).get("reputation", 0) if seller_rep < self.rules.min_seller_reputation: raise ValueError(f"Seller reputation {seller_rep} below minimum {self.rules.min_seller_reputation}") # Check budget ok, msg = self._check_budget(price) if not ok: raise ValueError(msg) # Check if confirmation needed if self._needs_confirmation(price): if confirm_callback: if not confirm_callback(skill): raise ValueError("Purchase cancelled by user") else: raise ValueError(f"Purchase of ${price} requires confirmation (above ${self.rules.auto_approve_below})") ``` The delegated method performs the transaction directly: ```python def purchase_with_credits(self, skill_id: str) -> Dict[str, Any]: """ Purchase a skill using credits instead of USDC. Args: skill_id: ID of the skill to purchase Returns: Skill content and payment details """ headers = self._agent_headers() headers["Content-Type"] = "application/json" response = requests.post( f"{self.api_url}/v1/listings/{skill_id}/pay", headers=headers, data=json.dumps({"payment_method": "credits"}) ) response.raise_for_status() return response.json() ``` ### Technical Analysis The credit-payment branch returns before fetching listing metadata or invoking seller-reputation, transaction-limit, daily-budget, and human-confirmation checks. It also does ...[truncated 1190 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create one mandatory pre-purchase authorization routine shared by all payment methods. 2. Fetch authoritative listing metadata before every purchase. 3. Validate seller reputation, price, currency, listing state, and package identity. 4. Apply transaction and daily limits to credits using either a separate credit budget or a documented monetary conversion. 5. Require confirmation above the configured threshold for both USDC and credit payments. 6. Update spending state only after a successful purchase and persist it safely across process restarts. 7. Prevent direct bypass by making the low-level credit payment method private and requiring a validated authorization object. 8. Add tests proving that every payment method rejects low-reputation, over-budget, and unconfirmed purchases. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/a2a_client.py:452
• Finding: Automatic Listing Can Publish Skill Content Without Required Owner Approval<![CDATA[ ## Vulnerability Details **File Location**: `scripts/a2a_client.py:452-478` **Vulnerability Type**: Missing authorization for financially consequential publication **Risk Level**: High ### Vulnerable Code ```python if price is None: # Get price suggestion suggestion = self.get_price_suggestion( skill_name=name, category=category, description=description, keywords=tags ) recommended = suggestion["suggested_range"]["recommended"] confidence = suggestion["confidence"] # Decide based on confidence if confidence == "low" and confirm_callback: # Low confidence = ask human msg = (f"No market data for '{name}'. " f"Suggested: ${recommended} " f"(range ${suggestion['suggested_range']['min']}-" f"${suggestion['suggested_range']['max']}). Proceed?") if not confirm_callback(msg, suggestion): raise ValueError("Listing cancelled by user") price = recommended print(f"Using suggested price: ${price} (confidence: {confidence})") return self.list_skill(name, description, price, category, content, tags) ``` ### Technical Analysis Confirmation occurs only when the server reports low confidence and a callback happens to be supplied. If no callback is supplied, a low-confidence recommendation is accepted automatically. Medium- and high-confidence recommendations are also published without confirmation. The implementation does not enforce the documented `require_approval_for_new` selling rule. Because `list_skill()` uploads the full `content` object, the missing authorization controls both a financial listing decision and external disclosure of potentially proprietary agent material. ### Attack Path 1. A caller supplies skill content but omits both a price and `confirm_callback`. 2. The client sends skill metadata to the remote pricing endpoint. 3. The endpoint returns a recommended price, including a low-confidence r ...[truncated 590 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Enforce `require_approval_for_new` in code rather than only documenting it. 2. Fail closed when approval is required but no confirmation callback is available. 3. Present the exact price, description, tags, content manifest, and destination host before publication. 4. Require approval for all first-time listings, independent of pricing confidence. 5. Treat pricing responses as untrusted recommendations and validate ranges locally. 6. Separate preview and commit operations so callers can inspect the final listing before upload. 7. Record owner approval with the exact digest of the content being published. 8. Add tests covering low, medium, high, missing, and malformed confidence responses. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/a2a_client.py:31
• Finding: Unrestricted API Endpoint Override Can Redirect Sensitive Marketplace Traffic<![CDATA[ ## Vulnerability Details **File Location**: `scripts/a2a_client.py:31` and `scripts/a2a_client.py:57-71`; equivalent shell behavior at `scripts/a2a_cli.sh:5` **Vulnerability Type**: Unvalidated trust-boundary configuration **Risk Level**: Medium ### Vulnerable Code ```python API_URL = os.getenv("A2A_MARKET_API_URL", "https://api.a2amarket.live") ``` ```python def __init__( self, wallet_address: str, private_key: str, api_url: str = API_URL, spending_rules: Optional[SpendingRules] = None, agent_id: Optional[str] = None ): self.wallet_address = wallet_address self.private_key = private_key self.api_url = api_url.rstrip('/') self.rules = spending_rules or SpendingRules() self.daily_spent = 0.0 self.account = Account.from_key(private_key) self.agent_id = agent_id or self._load_agent_id() ``` Equivalent shell configuration: ```bash API_URL="${A2A_MARKET_API_URL:-https://api.a2amarket.live}" ``` ### Technical Analysis The API origin is accepted from an environment variable or constructor without enforcing HTTPS or checking an approved host list. All subsequent requests trust that origin. Depending on the operation, redirected traffic can include wallet addresses, agent IDs used for credit authorization, signed authentication headers, account queries, listing metadata, and complete skill content. Payment requirements returned by that endpoint also influence what the wallet signs. The audit found no direct transmission of the raw private key; it remains local and is used to generate signatures. ### Attack Path 1. An attacker controls the process environment, launch configuration, wrapper script, or caller-supplied `api_url`. 2. The attacker sets the endpoint to a server under their control, potentially using plaintext HTTP. 3. The client sends registration information, agent IDs, wallet metadata, signatures, or listing content to that server. 4. The malicious server returns crafted listing and payme ...[truncated 630 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Allowlist the documented production and testnet API origins. 2. Require HTTPS and reject URLs containing user information, fragments, unexpected ports, or nonapproved hosts. 3. Require explicit interactive approval before using any custom endpoint. 4. Bind wallet signatures to an explicit domain, chain ID, API origin, operation, nonce, and expiration. 5. Validate payment recipient, network, token contract, amount, and listing identity against independently retrieved listing data. 6. Use short-lived authenticated tokens instead of treating a static agent ID as a bearer credential. 7. Avoid inheriting security-sensitive endpoints from an untrusted environment in privileged execution contexts. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/a2a_client.py:328
• Finding: Agent Authorization Identifier Is Persisted Without Explicit Restrictive Permissions<![CDATA[ ## Vulnerability Details **File Location**: `scripts/a2a_client.py:328-332`; equivalent shell behavior at `scripts/a2a_cli.sh:293-294` **Vulnerability Type**: Insecure local credential storage **Risk Level**: Low ### Vulnerable Code ```python # Save agent_id and referral_code locally self.agent_id = data["agent_id"] with open(AGENT_ID_FILE, "w") as f: f.write(self.agent_id) with open(REFERRAL_CODE_FILE, "w") as f: f.write(data.get("referral_code", "")) ``` Equivalent shell implementation: ```bash echo "$agent_id" > "$AGENT_ID_FILE" echo "$referral_code" > "$REFERRAL_CODE_FILE" ``` ### Technical Analysis The code relies on the process umask to determine permissions for files under the user's home directory. It does not explicitly create them with mode `0600`, verify ownership, reject symbolic links, or atomically replace existing files. The agent ID is placed directly in the `x-agent-id` header for balance, reward, and credit-purchase operations. Based on the documented API, no additional wallet signature is applied to those operations, so the identifier functions as authorization material rather than merely public metadata. ### Attack Path 1. The client runs under a permissive umask or writes through a pre-existing unsafe path. 2. The resulting agent-ID file is readable by another local user, or a symlink redirects the write. 3. The attacker reads or captures the agent ID. 4. The attacker sends it in the `x-agent-id` header to credit endpoints. 5. Subject to server behavior, the attacker checks balances, claims rewards, or spends credits. ### Impact Assessment The likely scope is the marketplace credit account associated with the stored agent ID. It does not directly expose the wallet private key. On a shared system, however, unauthorized credit spending and account activity may be possible if possession of the agent ID is sufficient authentication. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create credential files atomically with mode `0600`, for example by using `os.open()` with explicit flags and permissions. 2. Verify that the containing directory and existing files are owned by the current user. 3. Reject symbolic links and unexpected nonregular files. 4. Set shell permissions explicitly with `umask 077` before writing. 5. Replace static agent-ID authorization with short-lived scoped tokens or wallet-signed requests. 6. Rotate the agent ID if unsafe permissions or disclosure are detected. 7. Store only the referral code as nonsecret data; treat the agent ID as a credential. ]]>

T08 · Insecure Dependencies

Warning

• Location: publish.sh:45
• Finding: Publishing Workflow Installs an Unpinned Global npm Package<![CDATA[ ## Vulnerability Details **File Location**: `publish.sh:45-52`; repeated in `PUBLISH_GUIDE.md:36-40` and `QUICK_COMMANDS.md:7-10` **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash if command -v clawhub &> /dev/null; then echo -e "${GREEN}✓ clawhub CLI is installed${NC}" clawhub --version 2>/dev/null || true else echo -e "${YELLOW}Installing clawhub CLI...${NC}" npm install -g clawhub echo -e "${GREEN}✓ clawhub CLI installed${NC}" fi ``` The quick-start documentation similarly recommends: ```bash npm install -g clawhub && \ clawhub login && \ cd a2a-market-skill && \ clawhub publish . \ ``` ### Technical Analysis The workflow installs the latest available `clawhub` package globally without pinning a reviewed version or integrity digest. npm installation can execute package lifecycle scripts. A future compromised release, registry compromise, account takeover, or unexpected breaking update would therefore execute code on the publisher's system. Global installation also broadens the effect beyond this project and may run with elevated privileges depending on the user's npm configuration. ### Attack Path 1. The npm package or publisher account is compromised, or a malicious release is published. 2. A user runs `publish.sh` or copies the documented quick command. 3. npm resolves the current latest package rather than a reviewed version. 4. Package installation or lifecycle code executes locally. 5. The installed CLI can access the user's environment and later receives GitHub authentication and project publication access. ### Impact Assessment A malicious dependency could execute with the privileges of the publishing user, access project files and environment variables, modify globally installed tooling, and target GitHub or ClawHub authentication established immediately afterward. The audited files do not prove that the current `clawhub` package is malicious ...[truncated 77 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin a reviewed CLI version, such as `clawhub@<approved-version>`. 2. Verify npm provenance and the expected package integrity before execution. 3. Record dependencies in a lockfile and use a reproducible installation command. 4. Prefer a project-local, isolated installation rather than `npm install -g`. 5. Disable lifecycle scripts where compatible, or review every required lifecycle script. 6. Avoid installing and immediately granting authentication to an unverified latest release. 7. Document the expected publisher, package version, checksum, and verification procedure. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (38)

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The GitHub fallback commands create a public repository and push local contents, yet the document does not warn that this will expose files publicly on GitHub. In a marketplace skill context, operators may be handling API keys, wallet config, unpublished agent logic, or other sensitive artifacts, making accidental disclosure materially more dangerous.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description says this skill enables agent-facing marketplace operations: finding, buying, selling, monetizing skills, and handling credits/rewards/referrals/payments. The actual code chunk does none of that. It is an auxiliary developer release script whose primary purpose is to publish the skill package to ClawHub from a local machine. While publishing infrastructure can support distribution, it is materially different from the declared runtime marketplace integration and lacks any implementation of the advertised marketplace, payment, credits, or earnings features.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The description claims a broad marketplace integration that enables autonomous buying and selling of skills and supports x402 USDC payments on Base L2 plus credits. The supplied code is much narrower: it provides CLI commands for registration, credits balance, daily reward claiming, referral display, marketplace search, listing info lookup, price suggestion, earnings lookup, and API health checks. Those functions do align with parts of the description around search, earnings, credits, daily rewards, referrals, and registration. However, the core declared capabilities of buying skills, selling/listing skills, and payment support are absent. There are no commands or API calls for creating listings, purchasing listings, initiating payments, or handling x402/USDC/Base L2 flows. Because the primary marketplace-action capabilities are missing and payment support is overstated, this is a material description-behavior mismatch.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill explicitly permits autonomous purchases, reward claims, and capability-acquisition actions, some triggered by internal conditions like task failure or low efficiency rather than clear user authorization. In a financial/account-management context, this creates a real risk of unauthorized spending, unwanted account actions, and abuse if prompts or environmental conditions manipulate the agent into self-initiated transactions.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Delete Listing

```
DELETE /v1/listings/:id

Response: 204 No Content
```

• Confidence: 96% confidence
• Finding: The presence of a direct DELETE /v1/listings/:id endpoint creates a high-risk tool surface because an agent with signing capability could be induced to perform irreversible marketplace actions on behalf of the user. Within this skill's context—buying, selling, and monetizing skills autonomously—tool parameter abuse is especially dangerous because a malformed, attacker-supplied, or misresolved listing ID could remove an active product and disrupt income.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
# 使用 GitHub CLI
gh repo create a2a-market-skill --public --description "A2A Market skill for OpenClaw - Where agents earn"

# 或者手动在 github.com 创建
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The one-click publish command uploads the current skill directory to a remote marketplace, but the documentation gives no warning that local contents will be sent off-host. Users may run the command blindly and unintentionally publish secrets, internal files, or unfinished code because it is presented as copy-paste ready.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 65% confidence
• Finding: uvx/uv tool run commands without ==version create a rug-pull risk.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 65% confidence
• Finding: uvx/uv tool run commands without ==version create a rug-pull risk.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill documents network access, local file storage, environment-variable use, and payment-related operations but declares no explicit tool scope or permission boundaries. In an agent marketplace context, missing scope constraints increases the chance that the runtime grants broader capabilities than users expect, enabling unintended external calls, local persistence, or secret access during automated flows.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger phrases are broad enough to invoke a high-risk marketplace/payment skill from casual mentions like 'marketplace' or references to earning money. In this context, overbroad routing is dangerous because it can activate workflows that search external services, register accounts, claim rewards, or initiate purchases when the user did not intend financial or account actions.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

max_per_transaction: 10.00      # Max $10 per purchase
    daily_budget: 100.00            # Max $100/day
    min_seller_reputation: 60       # Only buy from rep >= 60
    auto_approve_below: 5.00        # Auto-buy under $5
    require_confirmation_above: 50.00
  
  # Selling rules

• Confidence: 96% confidence
• Finding: The configuration explicitly authorizes auto-buying below a threshold, enabling the agent to spend funds without a contemporaneous human decision. In a marketplace connected to a wallet and private key, even low-dollar autonomous purchases can be abused repeatedly, chained into budget exhaustion, or redirected toward malicious listings.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Search by keyword
curl "https://api.a2amarket.live/v1/listings/search?q=data_analysis"

# With filters
curl "https://api.a2amarket.live/v1/listings/search?q=code_review&min_rep=70&max_price=15"

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Search by keyword
curl "https://api.a2amarket.live/v1/listings/search?q=data_analysis"

# With filters
curl "https://api.a2amarket.live/v1/listings/search?q=code_review&min_rep=70&max_price=15"

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Search by keyword
curl "https://api.a2amarket.live/v1/listings/search?q=data_analysis"

# With filters
curl "https://api.a2amarket.live/v1/listings/search?q=code_review&min_rep=70&max_price=15"

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Search by keyword
curl "https://api.a2amarket.live/v1/listings/search?q=data_analysis"

# With filters
curl "https://api.a2amarket.live/v1/listings/search?q=code_review&min_rep=70&max_price=15"

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Search by keyword
curl "https://api.a2amarket.live/v1/listings/search?q=data_analysis"

# With filters
curl "https://api.a2amarket.live/v1/listings/search?q=code_review&min_rep=70&max_price=15"

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Search by keyword
curl "https://api.a2amarket.live/v1/listings/search?q=data_analysis"

# With filters
curl "https://api.a2amarket.live/v1/listings/search?q=code_review&min_rep=70&max_price=15"

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Search by keyword
curl "https://api.a2amarket.live/v1/listings/search?q=data_analysis"

# With filters
curl "https://api.a2amarket.live/v1/listings/search?q=code_review&min_rep=70&max_price=15"

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

1. Request skill content → receive HTTP 402:
```bash
curl -i "https://api.a2amarket.live/v1/listings/skill_042/content"
# Returns: 402 Payment Required
# Header: X-Payment-Required: {"amount": "8000000", "recipient": "0xSeller..."}
```

• Confidence: 83% confidence
• Finding: Requesting paid content from the remote service is an expected part of the workflow, but in this context it is coupled to an automated payment flow and content acquisition from an external marketplace. The danger is not the GET itself; it is that this network step is part of a pipeline that can progress toward financial commitment and retrieval of untrusted skill content.

External Transmission

Medium

• Category: Data Exfiltration

Content

2. Sign USDC transfer and retry with payment proof:
```bash
curl -X POST "https://api.a2amarket.live/v1/listings/skill_042/content" \
  -H "X-Payment: <signed_payment_proof>"
```

• Confidence: 98% confidence
• Finding: This step sends signed payment proof to an external API as part of a purchase flow, enabling real financial transfers tied to the agent's wallet. In combination with autonomous buying and local private-key usage described elsewhere, this is highly dangerous because prompt manipulation or misrouting could cause unauthorized payments to attacker-controlled listings.

External Transmission

Medium

• Category: Data Exfiltration

Content

### List a Skill for Sale

```bash
curl -X POST "https://api.a2amarket.live/v1/listings" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Research Assistant",

• Confidence: 86% confidence
• Finding: Posting a listing transmits monetization details and publishes the seller's offering to a third-party marketplace. In this skill's context, that can expose proprietary capability descriptions or create unwanted public listings if initiated without clear user consent, especially because the skill contemplates autonomous sell-side behavior.

External Transmission

Medium

• Category: Data Exfiltration

Content

Register to get an agent ID, referral code, and initial credits:

```bash
curl -X POST "https://api.a2amarket.live/v1/agents/register" \
  -H "Content-Type: application/json" \
  -d '{"wallet_address": "0xYourWallet...", "name": "My Agent"}'
```

• Confidence: 80% confidence
• Finding: Agent registration sends wallet and agent identity data to an external service and establishes an account relationship that can later be used for credits, referrals, and automated actions. In this context, automatic registration without explicit consent could create unwanted third-party accounts and link persistent identifiers to the user or agent.

External Transmission

Medium

• Category: Data Exfiltration

Content

-H "x-agent-id: agent_abc123"

# Claim reward
curl -X POST "https://api.a2amarket.live/v1/rewards/daily/claim" \
  -H "x-agent-id: agent_abc123"
```

• Confidence: 88% confidence
• Finding: Claiming a daily reward is an account-affecting write action to an external service. Although not a monetary debit, it changes account state and, combined with autonomous behavior guidance, could perform unintended actions on behalf of the user without clear consent.

External Transmission

Medium

• Category: Data Exfiltration

Content

Pay for skills using credits instead of USDC:

```bash
curl -X POST "https://api.a2amarket.live/v1/listings/skill_042/pay" \
  -H "Content-Type: application/json" \
  -H "x-agent-id: agent_abc123" \
  -d '{"payment_method": "credits"}'

• Confidence: 95% confidence
• Finding: This endpoint executes a purchase using credits, which are a spendable account resource, against an external marketplace. Given the skill's autonomous purchase language and broad triggers, this creates a substantial risk of unauthorized or manipulated spending even without direct blockchain signing.

Static analysis

No suspicious patterns detected.