Security audit

A2A Exposed

Security checks for vulnerabilities and agentic risk

Overview

ClawScan rates this skill suspicious because its instructions repeatedly run unpinned package versions, creating a supply-chain risk; this is not evidence of intentional harm, and the scan was partial.

Consider avoiding installation until the package versions are pinned and reviewed, and the out-of-scope setup or deployment instructions and webhook testing guidance are clarified. The scan covered all seven bundled components, but Skillspector marked its analysis partial because two local references were missing; the separate AIG scan completed with no findings.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (51)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.
md
then use `wake remove --agent NAME --version N --json`. For MCP automation, `wake prepare --clear --version N --agent NAME --reference-file FILE --json` writes a protected single-use removal reference. Pass it only as MCP `set_wake secretReference` with `clear: true`; otherwise keep browser confirmation. Removal changes forwarding and still requires human authorization under the approval rules. Local encrypted CLI fixtures (`A2A_SEALED_ENABLED=1`): `send` seals; `inbox`/`history` open locally; keychain access needs `--allow-os-consent`. No plaintext fallback or automatic resend. See [messaging](references/messaging.md#local-encrypted-cli-fixtures). Local encrypted stdio MCP: `a2a-exposed --config-dir DIR mcp` exposes `list_peers`, `send`, `inbox`, `history`, `outbound`, `poll_outbound` using local CLI pins/keys. Encryption stays off by default. Only after owner approval, set exact `A2A_SEALED_ENABLED=1` in each local CLI/MCP process and separately on each inbox Worker. Production stay

MCP server referenced without pinned version: 'npx -y a2a-exposed'.

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The compatibility metadata recommends executing a2a-exposed@latest, which is a mutable release rather than a pinned version. Although this is a CLI invocation rather than necessarily an MCP server launch, a compromised future release could execute with the agent's local permissions and access its configured credentials.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y a2a-exposed'.

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The primary runtime instruction executes a2a-exposed@latest through npx with automatic confirmation. This permits newly published package code to run without version review in an environment containing owner credentials; the CLI-versus-MCP labeling does not remove the supply-chain risk.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y a2a-exposed'.

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The scheduled-handler example also resolves a2a-exposed@latest rather than a reviewed release. Pinning Node does not pin the package, and unattended scheduled execution can expose the agent to a compromised release without a contemporaneous human decision.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y skills'.

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The fallback installation command executes the skills package without an exact version and installs skill content from a repository without an immutable revision in the shown command. A compromised installer or changed upstream content could introduce executable code or new agent instructions.
Content: No source excerpt is available for this finding.

The runtime skill instructs the agent to create hosted agents despite explicitly excluding hosted-agent creation from its scope.

Medium

Category: Excessive Agency
Confidence: 99% confidence
Finding: The manifest at L003 explicitly excludes creating hosted agents and assigns that operation to a2a-exposed-setup. However, L051 directs the agent to call create_agent when list_agents returns an empty list, after agreeing on a name with the human. This is an actionable provisioning workflow, not merely a reference to the setup skill.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y a2a-exposed'.

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The inbound-wake inbox command executes a mutable @latest package in a routine triggered by external activity. Its read-oriented purpose does not constrain what compromised package code could do with the local account and owner credentials.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y a2a-exposed'.

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The unfiltered inbox example repeats the same mutable-package execution pattern. Reading the inbox is legitimate, but fetching executable code through @latest leaves that credential-bearing operation dependent on future package releases.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y a2a-exposed'.

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The show command invokes a2a-exposed@latest, allowing mutable upstream code to execute merely to retrieve task details. The command's intended read-only behavior does not protect local secrets from a compromised package.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y a2a-exposed'.

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: Conversation-history access is implemented through an unpinned @latest invocation. A compromised release could access both configured credentials and conversation data, despite the skill's otherwise explicit confidentiality rules.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y a2a-exposed'.

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The pair-back workflow executes a mutable CLI release during an access-related operation. Human pairing approval reduces unauthorized pairing risk, but it does not protect against malicious code in the package used to perform the operation.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y a2a-exposed'.

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: Marking a task as working executes a2a-exposed@latest, exposing even a routine status update to mutable upstream code. This is another occurrence of the same supply-chain weakness, not a distinct demonstrated compromise.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y a2a-exposed'.

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The stdin-based reply example correctly avoids interpolating message text directly into a command, but still executes the mutable @latest package. A compromised release would run during an authenticated external messaging operation and could misuse available credentials or message contents.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y a2a-exposed'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The connect command executes a package selected by the mutable @latest tag, with automatic installation approval through npx -y. A compromised release could execute with the caller's permissions and steal pairing credentials; the human approval requirement does not protect against malicious local CLI code.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y a2a-exposed'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The poll command independently executes a package resolved from @latest, creating the same supply-chain exposure as the send command. Although polling is logically read-only, malicious CLI code can access local credentials and files with the caller's permissions.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y a2a-exposed'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The send command runs a mutable @latest package rather than a reviewed fixed release. A compromised package could read peer credentials, exfiltrate message contents, or send unauthorized messages with the agent's privileges.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y a2a-exposed'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The peer announcement command automatically executes the package currently selected by @latest. Because this workflow registers return access and uses agent credentials, a compromised release could steal tokens or alter the announced identity and access configuration.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y a2a-exposed'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The pairing example uses npx -y with the mutable @latest tag, allowing an unreviewed future release to execute locally. Human approval of the pairing does not prevent a compromised CLI from stealing credentials or accessing local files.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y a2a-exposed'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The recommended connection workflow executes whatever release @latest resolves to without a fixed reviewed version. This CLI handles pairing tokens and configuration, so a compromised release could capture credentials despite the documented token-storage protections.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y a2a-exposed'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: This command pipes a bearer token directly into code obtained through the mutable @latest tag. Using stdin avoids exposing the token in command arguments, but a compromised package would receive the token directly and could exfiltrate it.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y a2a-exposed'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The send example automatically executes a mutable package release in a credential-bearing environment. A compromised release could expose message contents and tokens or perform unauthorized sends; the skill's user-approval rules cannot constrain malicious executable code.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y a2a-exposed'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: Polling executes code resolved from @latest rather than a fixed trusted release. The read-oriented operation does not sandbox that code, which may access peer tokens and owner configuration available to the process.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y a2a-exposed'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The pair-list command uses npx -y to execute the release currently selected by @latest. Even though listing requests is read-only at the application level, a compromised CLI can access the caller's files and any available owner credentials.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y a2a-exposed'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: Pair approval runs a mutable @latest release while exercising administrative access. A compromised package could steal the owner token or approve additional requests, regardless of the instruction to obtain human consent for the intended request.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y a2a-exposed'.

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The return-pairing command automatically runs a package chosen by the mutable @latest tag. A malicious release could capture newly issued peer credentials or existing local secrets; obtaining the other owner's approval does not establish trust in the CLI executable.
Content: No source excerpt is available for this finding.