Back to skill
Skillv1.0.0
VirusTotal security
A2a Manager · External malware reputation and Code Insight signals for this exact artifact hash.
Scanner verdict
SuspiciousApr 30, 2026, 5:03 AM
- Hash
- 327a7311f06216a08dd7767ffc0d024c1f528998d8c9522bbaba8b3f6e1178c4
- Source
- palm
- Verdict
- suspicious
- Code Insight
- Type: OpenClaw Skill Name: a2a-manager Version: 1.0.0 The skill is classified as suspicious due to several critical vulnerabilities. The `scripts/create_agent.py` script uses `shutil.rmtree` on a path derived from user-controlled input (`agent_name`), which could lead to path traversal and arbitrary file/directory deletion outside the intended workspace. Additionally, multiple scripts (`scripts/a2a_map.py`, `scripts/create_agent.py`) construct Markdown configuration files (e.g., `A2A_MAP.md`, `SOUL.md`, `IDENTITY.md`) using f-strings with user-provided data, creating a Markdown injection vulnerability. This could corrupt agent configurations or be leveraged for prompt injection against the agent itself. While the `scripts/task_board.py` script makes external network calls to Notion, this is for its stated purpose and does not show signs of unauthorized data exfiltration.
- External report
- View on VirusTotal