Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only skill for troubleshooting A2A agent connections, with credential-handling risks that are disclosed enough to manage.
Install only if you need A2A agent-connection guidance. When using it, treat bearer tokens as credentials, keep agent-card URLs on HTTPS, store tokens in approved secret storage, and avoid putting token values in notes, logs, or chat messages.
The description says to use the skill when a task needs something only another agent can do, or when told to 'link' two agents and setup is not working. This activation guidance is broad and lacks explicit constraints or negative examples, so it could overlap with ordinary troubleshooting or collaboration requests and cause unintended invocation.
The markdown explains that peers may send bearer tokens in the clear and later instructs readers to record how the token is stored, but it does not include a clear warning to protect credentials or avoid exposing secrets in logs, notes, or insecure channels. Because the skill deals directly with authentication material and possible plaintext transmission, a user-facing warning is warranted.
No suspicious patterns detected.
