a2a-Market-UCP-Broadcast

Implement UCP broadcast of buyer intents to eligible nodes, including message signing, routing, and ack handling. Use when building universal commerce protoc...

Security Scan

The skill's described purpose and protocols are coherent, but the runtime claims and signing requirements are not represented in the package (no code, no declared key/env requirements), which is inconsistent and worth caution.

Purpose & Capability

Name, description, and SKILL.md goals (intent payloads, signing, broadcast, ack collection) are consistent with a UCP broadcast helper. However the SKILL.md asserts a local 'runtime' implementation and test paths (runtime/src/..., npm test) while this published bundle contains no code or install spec — suggesting either missing artifacts or that the skill depends on out-of-band code.

Instruction Scope

The instructions specify signing (sign_intent(intent, private_key)) and runtime behavior but do not describe how private keys are stored/obtained, nor do they constrain where the agent should look for code or run tests. That leaves scope for the agent or integrator to locate sensitive keys or external code at runtime without guidance.

Install Mechanism

This is an instruction-only skill with no install spec and no binaries to download or extract — low installation risk. The lack of an install step is coherent with the absence of code, but exacerbates the issue that expected runtime artifacts are missing.

Credentials

No environment variables, credentials, or config paths are declared, yet core functionality requires signing with a private_key. The skill should declare how signing keys are provided (env var, secret store, config path). The omission is disproportionate and could lead to ad-hoc handling of sensitive keys.

Persistence & Privilege

The skill is not marked always:true and has no install-time persistence; it cannot force inclusion on every agent run. There is no evidence it modifies other skills or system-wide settings.

What to consider before installing

Proceed cautiously. The SKILL.md describes message signing and references a local runtime implementation and tests, but this package contains no code or declared secrets/env vars for private keys. Before installing: (1) ask the publisher to provide the referenced runtime code or a clear install spec; (2) require an explicit, minimal method for providing signing keys (for example, a single declared env var or secret-store path) and documentation for key management; (3) verify the provenance of any external runtime package and review its tests; (4) avoid supplying private keys to the agent directly — prefer a secret store or scoped key with limited privileges; and (5) if you still want to try it, run the implementation and tests in an isolated environment and inspect network behavior to ensure broadcasts go only to intended endpoints. These inconsistencies (missing code and undeclared key handling) are the main reason this is flagged as suspicious.

Define the transport and protocol shell for intent broadcast in UCP.

Current status: framework release for registration. Prioritize interoperability contracts over optimization.

Scope

• Build intent payload schema and canonical signing routine.
• Broadcast to eligible nodes and track delivery acknowledgements.
• Feed response stream into quote intake service.

Suggested Project Layout

• app/protocol/ucp/intent_message.py
• app/protocol/ucp/signer.py
• app/application/services/broadcast_service.py
• app/infrastructure/ws/ucp_gateway.py

Minimum Contracts (MVP P0)

1. build_intent(payload) normalizes and version-tags message.
2. sign_intent(intent, private_key) returns detached signature object.
3. broadcast(intent_id, target_nodes) returns dispatch receipt ids.
4. collect_acks(intent_id, timeout_ms) returns per-node ack status.

Event Mapping

• Emit INTENT_CREATED before dispatch.
• Emit INTENT_BROADCASTED after fan-out completes.
• Emit NODE_RESPONDED when quote/ack arrives.

Guardrails

• Keep canonical JSON serialization deterministic for signing.
• Record per-node retry counters and stop after configured threshold.
• Attach protocol version in every envelope.

Implementation Backlog

• Add adaptive node selection based on reputation percentile.
• Add dead-letter handling for nodes with repeated timeouts.

Runtime Implementation

• Status: implemented in local runtime package.
• Primary code paths:
• runtime/src/protocol/ucp-client.js
• runtime/src/application/market-agent.js
• Validation: covered by runtime/tests and npm test in runtime/.