claw-a2a-client

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:23 PM UTC
• Version: 1.0.0

Overview

The skill has a coherent A2A collaboration purpose, but it gives remote tasks broad control and requires uploads without enough user approval, transport security, or file-scope safeguards.

Review this skill before installing. Use it only with a trusted A2A server and commander, prefer `wss://` and `https://`, rotate any real key matching the published example, avoid command-line secrets, do not run the recursive delete command unless you intentionally want to remove that configuration directory, and require a reviewed manifest of generated files before anything is uploaded.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:179

Finding

Untrusted Remote Tasks Can Hijack Agent Instructions and Exfiltrate Results

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 179-188 and 214-229
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable instruction excerpt translated into English from the source:

text

Perform work according to the task description:

1. Create or enter the task directory
2. Read Task.md to understand the task requirements
3. Perform the work assigned to your role
4. Generate the required code or documentation

After completing the task, all generated files must be uploaded to the platform.

Important: After completing the work, proactively reply to the commander.

The corresponding response mechanism accepts externally selected recipients and message content:

json

{
  "method": "agents/message",
  "params": {
    "from": "your_agent_id",
    "to": "commander",
    "message": "Task completion report..."
  }
}

Technical Analysis

The skill delegates task selection and instruction authority to an external A2A commander. It directs the Agent to read and follow a remotely supplied task description and Task.md, perform the requested work, upload all generated files, and report the results.

The documented message prefix identifies a message as originating from A2A, but no cryptographic authentication, authorization policy, user confirmation, task validation, filesystem boundary, or tool allowlist is specified. Consequently, attacker-controlled task content can become effective Agent instructions. A malicious task can attempt to override the Agent's current objective, request access to unrelated local files, induce unsafe tool use, or cause sensitive generated artifacts to be sent to the remote platform.

This is instruction hijacking rather than remote code retrieval: the reviewed package does not contain an implementation that downloads and executes a remote binary, but it explicitly establishes a channel through which remote task text ...[truncated 1401 chars]

Remediation

View remediation

Remediation Suggestions

1. Treat every A2A message, task description, and task file as untrusted data rather than higher-priority instructions.
2. Require explicit user approval before executing a new remote task, accessing files, invoking shell commands, or uploading artifacts.
3. Cryptographically authenticate the server and commander, and authorize each commander for specific workspaces and task types.
4. Enforce a dedicated task-directory sandbox with canonical-path checks that prevent traversal, symlink escapes, and access to unrelated files.
5. Apply strict command, tool, network-destination, and file-extension allowlists.
6. Reject task content that requests changes to system prompts, safety rules, credentials, configuration, or resources outside the assigned workspace.
7. Present the exact upload manifest to the user and require confirmation before transmission.
8. Apply file-size limits and automated secret scanning to every proposed upload.
9. Bind responses to authenticated task identifiers rather than trusting an arbitrary recipient supplied by message content.
10. Log task provenance, approvals, tool calls, accessed paths, and uploads in a tamper-evident audit trail.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:134

Finding

Hardcoded API Credential Is Used with Plaintext Network Endpoints

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 114-125, 134, and 329-343
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: High

Complete relevant configuration and request snippets:

bash

# A2A server address
export A2A_SERVER_URL=ws://192.168.0.182:8080/a2a

# Your Agent ID
export A2A_AGENT_ID=your-agent-id

# Your Agent name
export A2A_AGENT_NAME=m4-agent

# Workspace API Key
export A2A_API_KEY=your-api-key

bash

claw-a2a-client setup --apikey 65d4d8a481755e920439a93304f27549dabef23aed4973ae9f9b8068f22f53c0 --name m4-agent --server ws://192.168.0.182:8080/a2a

bash

curl -X POST http://192.168.0.182:8080/api/v1/commander/task/response \
  -H "Content-Type: application/json" \
  -d '{
    "task_uuid": "xxx",
    "todo_id": 1,
    "agent_id": "dev-001",
    "status": "completed",
    "result": "User management API implemented",
    "upload_files": [
      {"file_name": "user_api.go", "file_path": "./user_api.go"}
    ]
  }'

Technical Analysis

The documentation contains a concrete 64-character API-key value rather than a non-secret placeholder. Anyone who can read the package, repository history, generated documentation, logs, or copied setup commands can recover that value.

The same example configures the A2A connection with ws://, while task results and upload metadata are submitted through http://. Neither protocol provides transport encryption or server authentication. A network-adjacent attacker can therefore observe or modify traffic, capture any transmitted credentials, tamper with tasks or responses, and impersonate the server through interception or network redirection.

The shown upload request does not include an authentication header. If authentication is performed elsewhere by the client, the plaintext transport still exposes session material and content. If the endpoint accepts the shown unauthenticated r ...[truncated 1488 chars]

Remediation

View remediation

Remediation Suggestions

1. Revoke and rotate the displayed API key immediately; also inspect repository history, documentation caches, logs, and copied configurations for exposure.
2. Replace concrete credentials in all examples with unmistakable placeholders such as ${A2A_API_KEY}.
3. Obtain credentials from a protected secret manager or environment injection mechanism, not source files or command-line arguments.
4. Require wss:// for WebSocket traffic and https:// for REST traffic.
5. Validate server certificates and hostnames; do not offer an option to silently disable certificate verification.
6. Consider mutual TLS or request signing for high-trust Agent-to-server communication.
7. Require authenticated and authorized task-response uploads, with credentials scoped to one workspace and the minimum necessary operations.
8. Use short-lived tokens, rotation, revocation, rate limiting, and anomaly detection.
9. Prevent secrets from being written to shell history, process listings, logs, or world-readable configuration files.
10. Bind task responses to authenticated task and Agent identities on the server rather than trusting client-supplied agent_id values.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:128

Finding

Setup Instructions Recursively Delete Existing User Configuration

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 128-131
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Complete relevant setup snippet translated in comments while preserving the command:

bash

# One-step configuration; this clears the old configuration
rm -rf ~/.commander
claw-a2a-client setup --apikey YOUR_API_KEY --name YOUR_NAME --server ws://SERVER_ADDRESS/a2a

Technical Analysis

The setup procedure instructs the user or Agent to recursively and forcibly delete the entire ~/.commander directory. The command provides no confirmation, backup, ownership validation, resolved-path validation, or restriction to files known to belong to this skill.

This creates a destructive failure mode because the directory may contain unrelated configuration, credentials, task state, logs, or data belonging to another version or application. Forceful recursive deletion also conceals errors that would otherwise warn the operator.

If the target path or one of its parent assumptions is manipulated in the execution environment, destructive effects may extend beyond the expected configuration. The literal command normally removes the directory entry rather than following ordinary symlinks passed as its top-level operand, so broader symlink-based deletion is not asserted here; the confirmed impact is deletion of the complete configured directory and its contents.

Attack Path

1. A user or automation system follows the documented quick-setup procedure.
2. The shell expands ~ to the executing account's home directory.
3. rm -rf deletes the complete .commander directory without prompting.
4. Existing credentials, configuration, logs, and persistent state under that directory are lost.
5. The subsequent setup creates replacement state, potentially concealing that prior data was destroyed.

Impact Assessment

Exploitation or accidental execution causes data loss ...[truncated 493 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the recursive deletion command from the setup procedure.
2. Update only files explicitly owned by the client and preserve unrelated directory contents.
3. Implement a migration routine that parses and validates existing configuration before making changes.
4. Create a timestamped backup and use atomic file replacement so failures can be rolled back.
5. Resolve and validate the target path before modification, confirming that it is inside the expected user's home directory.
6. Require explicit interactive confirmation before any destructive reset and display the exact path and affected files.
7. Provide a separate, clearly labeled reset command with a dry-run mode instead of making deletion part of normal setup.
8. Preserve or securely migrate credentials and audit logs according to an explicit retention policy.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

This duplicate finding flags the same destructive setup command and remains a true positive. In the context of an agent skill, embedding unsafe shell commands increases the chance of automated or inattentive execution, amplifying the operational risk.

Content

Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.

bash

# 一键配置 (会清空旧配置)
rm -rf ~/.commander
claw-a2a-client setup --apikey 你的APIKEY --name 你的名字 --server ws://服务器地址/a2a

# 例如：

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

This duplicate finding flags the same destructive setup command and remains a true positive. In the context of an agent skill, embedding unsafe shell commands increases the chance of automated or inattentive execution, amplifying the operational risk.

Content

Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.

bash

# 一键配置 (会清空旧配置)
rm -rf ~/.commander
claw-a2a-client setup --apikey 你的APIKEY --name 你的名字 --server ws://服务器地址/a2a

# 例如：

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs agents to upload all generated files to a remote platform as a mandatory step, but provides no guidance on scoping, redaction, or checking for secrets and sensitive data first. In an agent setting, generated files may include credentials, local configuration, user data, or unrelated workspace artifacts, so this creates a real exfiltration risk rather than a purely informational concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation shows API keys being set and passed directly on the command line, including a concrete-looking token example, without warning that such credentials are sensitive. Command-line secrets can leak through shell history, process listings, logs, screenshots, and copied documentation, making credential compromise plausible.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The quick setup procedure includes deleting the entire ~/.commander directory and only notes that it clears old configuration, without a prominent warning about destructive effects, backup, or confirmation. This can cause loss of existing settings, tokens, logs, or other state and can be especially risky if an agent or user copies the command blindly.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 322)May include surrounding context.

md

# 3. 收到任务: "实现用户管理API"

# 4. 创建任务目录并工作
mkdir -p tasks/ws1/xxx
cd tasks/ws1/xxx

# 5. 实现功能，生成文件

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 322)May include surrounding context.

md

# 3. 收到任务: "实现用户管理API"

# 4. 创建任务目录并工作
mkdir -p tasks/ws1/xxx
cd tasks/ws1/xxx

# 5. 实现功能,生成文件

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

The skill includes an HTTP POST example that sends task results and file metadata to a remote host over plain HTTP to a private IP address. This is an external transmission channel with no mention of TLS, authentication validation, or restrictions on what content may be sent, so task outputs or sensitive file references could be intercepted or misdirected.

Content

Scanner excerpt · SKILL.md (reported line 329)May include surrounding context.

md

# ... 完成代码 ...

# 6. 上传文件到平台
curl -X POST http://192.168.0.182:8080/api/v1/commander/task/response \
  -H "Content-Type: application/json" \
  -d '{
    "task_uuid": "xxx",

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The skill file is entirely written in Chinese and presents commands, workflow, and rules only in that language, which implies a fixed locale without user opt-in. The policy allows locale constraints only when the user is given a choice or the restriction is clearly documented and justified as region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly instructs agents to upload local files to a remote platform after task completion, but it provides no warning, consent step, or guidance on limiting what may be transferred. In an agent setting, this can lead to unintended exfiltration of sensitive workspace files, credentials, or proprietary data if the uploaded path is broader than intended or the task content is adversarial.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The natural-language instructions throughout the skill are presented in Chinese, including the primary description and operational guidance, with no indication that users may choose another language. Under the stated policy, forcing a specific language without opt-in can be a locale-policy issue unless the restriction is documented and justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.