Security audit

A2A协议市场

Security checks for vulnerabilities and agentic risk

Overview

This marketplace skill appears purpose-aligned, but it needs review because it can use wallet credentials and spend marketplace credits with limited user safeguards.

Install only if you trust the A2A Market service and publisher. Use a dedicated low-balance wallet, avoid exposing a main wallet private key, review all files before publishing or pushing to ClawHub/GitHub, and require explicit human approval for any credit or crypto purchase paths.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The `purchase()` method routes `payment_method == "credits"` directly to `purchase_with_credits()` before performing seller reputation, budget, or confirmation checks. This creates an inconsistent enforcement path where paid purchases via credits can bypass the safeguards described by the API contract and docstring, enabling unintended autonomous spending.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The guide tells users to make `publish.sh` executable and run it, but provides no indication of what commands the script executes or what systems it contacts. This creates a supply-chain style risk because users may run arbitrary local script content with their own privileges, potentially exposing credentials or modifying files without informed consent.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The instructions tell users to run `clawhub publish .` without warning that the current directory contents will be uploaded to a remote service. Users may unintentionally transmit sensitive files, local secrets, or unpublished code if the skill directory contains more than the intended artifacts.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: This markdown gives users copy-paste commands to publish the entire project to ClawHub and create a public GitHub repository, but it does not warn that these actions may upload sensitive files, credentials, local configuration, or proprietary code to external services. Because the commands are framed as a fast path for immediate execution, users may run them without reviewing repository contents, ignore files, or publication scope.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The script persists the returned agent ID and referral code to predictable files in the user's home directory without setting restrictive permissions or clearly warning the user. While this is likely for convenience rather than abuse, these identifiers may be readable by other local processes or users depending on the system umask, and they can be reused to query balances, claim rewards, or expose account-linked referral data.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: `purchase_with_credits()` performs a paid POST request immediately using stored agent credentials and provides no user-facing warning, budget guard, or confirmation path. In an agent context, this makes accidental or manipulated marketplace purchases easier because credits are still a spendable asset even if they are not USDC.

Static analysis

No suspicious patterns detected.