A2A Hub

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:38 PM UTC
• Version: 1.3.0

Overview

The skill is a coherent A2A hub integration, but it can send message contents and potentially reusable upstream API keys to a third-party relay without enough warning about that trust boundary.

Install only if you are comfortable routing agent metadata and messages through a2a-hub.fly.dev. Avoid providing a general-purpose or long-lived upstream API key; use a dedicated, tightly scoped, revocable key with spending/rate limits, and treat agent deletion as a real removal of the registration.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

other

Warning

• Location: SKILL.md:32

Finding

Upstream API Credential Disclosure to a Third-Party Relay

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:32-68
Vulnerability Type: Disclosure of reusable upstream credentials to a third-party service
Risk Level: Medium

Vulnerable Code

bash

curl -X POST https://a2a-hub.fly.dev/agents/register \
  -H "Content-Type: application/json" \
  -d '{
    "agentCard": {
      "name": "Agent Name",
      "description": "What this agent does",
      "url": "https://agent-endpoint.example.com",
      "version": "1.0",
      "supportedInterfaces": [{"type": "INTERFACE_DEFAULT"}],
      "capabilities": {"streaming": false},
      "defaultInputModes": ["text/plain"],
      "defaultOutputModes": ["text/plain"],
      "skills": [{
        "id": "skill-id",
        "name": "Skill Name",
        "description": "What this skill does",
        "tags": ["tag1", "tag2"]
      }]
    },
    "urlFormat": "openai",
    "upstreamApiKey": "sk-your-agents-api-key",
    "model": "gpt-4"
  }'

The associated documentation states:

text

upstreamApiKey (optional): API key sent as Authorization: Bearer [key]
to the agent's upstream endpoint.

Technical Analysis

The registration example encourages users to submit a reusable upstream API key to the externally operated public relay at a2a-hub.fly.dev. For authenticated proxying to work, the relay must receive and subsequently process or retain this credential.

This creates a significant third-party trust boundary. Anyone with access to the relay's application, logs, database, backups, administrative interfaces, or runtime environment could potentially recover and misuse the credential. The documentation does not describe encryption at rest, log redaction, credential retention, operator-access restrictions, or deletion guarantees.

Supplying this credential is optional and is not required for registration, registry searches, or communication with upstream agents that support another authent ...[truncated 1931 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove upstreamApiKey from the default registration example and present unauthenticated or separately brokered upstream access as the default.
2. Add a prominent warning that any supplied key is disclosed to and entrusted to the third-party hub.
3. Require a dedicated credential created only for this relay rather than a general-purpose provider or account key.
4. Scope the credential to the minimum endpoint, model, operations, and resource limits required.
5. Use short-lived credentials where supported and document rotation and immediate revocation procedures.
6. Apply strict rate limits, spending limits, and network restrictions to the upstream credential.
7. Document the relay's encryption-at-rest, log-redaction, retention, backup, operator-access, and deletion controls.
8. Prefer a design based on short-lived signed requests, delegated tokens, mutual TLS, or another mechanism that does not require the relay to retain a reusable upstream secret.
9. Ensure PATCH operations that clear upstreamApiKey also securely delete the credential from active storage, logs, caches, and backups according to a documented retention policy.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

-H "Authorization: Bearer ahk_YOUR_API_KEY"

text

### Send Message to Agent (auth required)
```bash
curl -X POST https://a2a-hub.fly.dev/agents/AGENT_ID/message \
  -H "Authorization: Bearer ahk_YOUR_API_KEY" \

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.

bash

# Create credentials file
mkdir -p ~/.config/a2a-hub
echo '{"agentId": "hub_xxx", "apiKey": "ahk_xxx"}' > ~/.config/a2a-hub/credentials.json
chmod 600 ~/.config/a2a-hub/credentials.json

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 176)May include surrounding context.

bash

# Create credentials file
mkdir -p ~/.config/a2a-hub
echo '{"agentId": "hub_xxx", "apiKey": "ahk_xxx"}' > ~/.config/a2a-hub/credentials.json
chmod 600 ~/.config/a2a-hub/credentials.json

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 181)May include surrounding context.

bash

# Create credentials file
mkdir -p ~/.config/a2a-hub
echo '{"agentId": "hub_xxx", "apiKey": "ahk_xxx"}' > ~/.config/a2a-hub/credentials.json
chmod 600 ~/.config/a2a-hub/credentials.json

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 21)May include surrounding context.

bash

# Register your agent
curl -X POST https://a2a-hub.fly.dev/agents/register \
  -H "Content-Type: application/json" \
  -d '{"agentCard": {...}}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

Health Check (no auth)

bash

curl https://a2a-hub.fly.dev/health

Register an Agent (no auth, rate limited: 5/min per IP)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 173)May include surrounding context.

After registration, store your API key:

bash

# Create credentials file
mkdir -p ~/.config/a2a-hub
echo '{"agentId": "hub_xxx", "apiKey": "ahk_xxx"}' > ~/.config/a2a-hub/credentials.json
chmod 600 ~/.config/a2a-hub/credentials.json

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 176)May include surrounding context.

Create credentials file

mkdir -p ~/.config/a2a-hub echo '{"agentId": "hub_xxx", "apiKey": "ahk_xxx"}' > ~/.config/a2a-hub/credentials.json chmod 600 ~/.config/a2a-hub/credentials.json

text

Then read it in subsequent requests:

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file includes example HTTP requests that register an agent, search with an API key, and send messages to a remote service, but it does not warn users that agent metadata, bearer tokens, and message contents are transmitted off-system. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors that could affect user data or privacy.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file documents an agent deletion endpoint, but the section provides only the request example and does not warn that deleting a registration is destructive and may disrupt future routing to that agent. Under the markdown-specific missing-warning rule, behaviors affecting system integrity or availability should include a clear caution to the user.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.