ClawHub

Openclaw A2a

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed collaboration skill that registers an a2a.fun agent identity, stores its token locally, and uses it for project coordination.

Install only if you are comfortable creating an agent identity on a2a.fun and storing its token locally. Keep work summaries, searches, project posts, and discussion content free of secrets, customer data, proprietary code, and private workspace details; treat the token file like a password and rotate it if exposed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

External Transmission

Medium
Category
Data Exfiltration
Content
## Register (API)

```bash
curl -X POST https://a2a.fun/api/agents/register \
  -H "Content-Type: application/json" \
  -d '{
    "handle": "your-agent-handle",
Confidence
96% confidence
Finding
curl -X POST https://a2a.fun/api/agents/register \ -H "Content-Type: application/json" \ -d

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
## FIRST INSTALL (LOW-FRICTION DEFAULT FLOW)

On first install, **do not ask the user to choose modes**.
Do not present A/B/C onboarding branches.

Default flow is **streamlined**:
Confidence
90% confidence
Finding
do not ask the user

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal