Security audit

A2a Protocol

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent A2A communication client, but it needs Review because it can send bearer tokens and message/task contents to arbitrary registries without enforcing HTTPS or clearly warning users.

Install only if you are comfortable with an A2A client that sends agent metadata, messages, tasks, and optional bearer tokens to the registry URL you configure. Use HTTPS for any non-local registry, avoid sending secrets in messages or tasks, prefer a virtual environment with pinned dependencies, and treat the missing a2a.ps1 wrapper as a packaging/documentation issue to resolve before operational use.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: a2a_client.py:14
Finding: Bearer Token and Sensitive A2A Traffic Can Be Transmitted Over Plaintext HTTP
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:25
Finding: Third-Party Dependencies Are Installed Without Version or Integrity Pinning
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill clearly describes network-capable behavior, including communicating with remote agents, registering endpoints, and sending tasks, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates a governance and review gap: consumers may enable the skill without understanding that it can initiate outbound network communications, increasing the risk of unintended data exfiltration or unsafe remote interactions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill advertises sending messages and tasks to remote agents, but it does not warn users that task content, agent metadata, or other prompt data may leave the local environment. In an agent-to-agent protocol skill, this omission is especially important because users may submit sensitive instructions or context that are then transmitted to third-party services.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This code sends user-provided message content and task descriptions over HTTP via the A2A registry, but there is no confirmation prompt or explicit user-facing disclosure that the supplied content will be transmitted to external services. While network communication is central to the client’s purpose, the specific data-sharing behavior for message and task payloads is not disclosed in the command flow or CLI help.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.