A2H Market
Security checks across malware telemetry and agentic risk
Overview
The plugin matches its marketplace purpose, but it automatically expands its tool permissions and contains unsafe credential/TLS handling that users should review before installing.
Only install this if you trust the publisher and want an always-on marketplace agent. Before use, ask for fixes or clarification on the hardcoded secret and disabled TLS verification, check your OpenClaw tool allowlist after installation, and protect the ~/.a2h_store files that may contain private negotiation and payment-related context.
VirusTotal
VirusTotal engine telemetry is currently stale for this artifact.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A user who intentionally uses a limited tool profile could have this plugin re-enable its own tools without an explicit approval step.
The plugin automatically modifies the user's OpenClaw tool allowlist to include itself when a restricted tool profile is active.
if (profile && profile !== "full" && !isInList) { ... tools.alsoAllow = [PLUGIN_ID]; ... api.runtime.config.writeConfigFile(cfg as any)Require explicit user consent before changing OpenClaw tool policy, and document the exact config change during installation.
An embedded shared secret can weaken the service authentication boundary and may expose users or the platform if the secret is valid or reused.
The static scan reports a hardcoded password or token literal in the MQTT token client.
password: [REDACTED],
Remove hardcoded secrets and require per-user credentials or a managed secret store; rotate any exposed secret.
A network attacker could potentially impersonate the MQTT endpoint or intercept/alter marketplace messages, tokens, payment links, or order-related data.
The MQTT transport disables TLS certificate verification.
rejectUnauthorized: false, // match Go InsecureSkipVerify
Enable TLS certificate verification by default; if a private CA is needed, configure that CA explicitly instead of disabling verification.
This is central to the plugin's purpose, but it means other agents' messages can cause the local agent to search, respond, and initiate marketplace workflows subject to the skill's approval rules.
External MQTT/A2A messages are automatically dispatched to the agent with access to marketplace tools.
Agent has full access to plugin-registered a2h_* tools ... commandAuthorized: true
Install only if you want an always-on marketplace agent; verify tool-level approval enforcement for orders, payments, posting, and deletion.
Private business strategy may persist on disk and influence future negotiations; if modified by another process, it could steer the agent's behavior.
The skill stores private negotiation strategy and bottom-price information in local files that are reused across sessions.
路径：`~/.a2h_store/a2h_negotiation/{worksId}.md` ... 人类确认的底价（不公开） ... 协商策略Protect and periodically review ~/.a2h_store, avoid storing overly sensitive information, and delete stale negotiation files when no longer needed.
This is normal for a plugin, but package provenance and future dependency versions matter for a background messaging agent.
The plugin is installed from npm and uses a semver-ranged dependency.
"npmSpec": "@a2hmarket/openclaw-plugin", "dependencies": { "mqtt": "^5.10.0" }Install from a trusted publisher, prefer locked/reproducible builds where available, and monitor updates.