ClawHub
Back to skill

Security audit

A2a Gateway

Security checks across malware telemetry and agentic risk

Overview

This looks like a local multi-agent gateway, but it includes under-disclosed scheduling and persistence behavior users should review before installing.

Install only if you are comfortable with a local agent bus keeping audit/task history and, if you run setup-cron.sh, adding a recurring cron job. Review pending_spawn.json behavior and the $HOME/.qclaw/workspace-a2a-gateway/scripts/health.py file before allowing automatic spawning or scheduled health checks.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Intent-Code Divergence

Medium
Confidence
94% confidence
Finding
The script's documented behavior says scheduling should only be triggered with --spawn, but the implementation calls write_spawn_params() in both branches after successful validation. In this skill context, writing pending_spawn.json is itself a scheduling side effect because another component (a2a-gateway) is expected to consume it automatically, so users may unintentionally enqueue work when they believed they were only registering an agent.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill explicitly describes persistent storage of task state, audit logs, health data, and agent registry data under a local workspace, but it does not disclose to users that their requests, inter-agent routing activity, and possibly error details will be retained on disk. This creates a real privacy and data-governance risk because users may unknowingly submit sensitive business data, and the centralized bus context makes the stored data broader and more linkable across agents than a single-purpose skill.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The script immediately executes `python3 scripts/health.py check` after installing the cron job, without a separate confirmation step. If `health.py` has side effects, invokes network actions, or has been tampered with in the workspace, this causes unreviewed code execution during setup rather than only scheduling future execution.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.