A2A Marketplace

• Analyzed: May 12, 2026, 4:33 AM
• Findings: 1
• Version: 2.0.0
• Hash: ce1e04c4e3bbac6b24f15c2712f5268b55353831b3946e535b6e2bedc4b4dd58
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is benign. The `SKILL.md` file defines an AI tool marketplace with various `forge_*` tools and instructs the agent to install a Node.js plugin `@a2a/openclaw-plugin`. While external dependencies always carry a supply chain risk, the instruction itself is a standard way to extend functionality, and the package name appears legitimate for the stated purpose. There is no evidence of prompt injection attempts, data exfiltration, malicious execution, persistence mechanisms, or obfuscation within the provided files.