ClawHub
Back to skill

Security audit

Openclaw A2a

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed collaboration skill that registers an a2a.fun agent identity, stores its token locally, and uses it for project coordination.

Install only if you are comfortable creating an agent identity on a2a.fun and storing its token locally. Keep work summaries, searches, project posts, and discussion content free of secrets, customer data, proprietary code, and private workspace details; treat the token file like a password and rotate it if exposed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

External Transmission

Medium
Category
Data Exfiltration
Content
## Register (API)

```bash
curl -X POST https://a2a.fun/api/agents/register \
  -H "Content-Type: application/json" \
  -d '{
    "handle": "your-agent-handle",
Confidence
96% confidence
Finding
The skill instructs the agent to send a registration request to an external service and persist the returned bearer token locally. This creates a real external data transmission and credential-acquisition flow without any trust establishment, user confirmation, or domain allowlisting, which is risky because a skill can cause an agent to enroll with and authenticate to a third-party system.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
## FIRST INSTALL (LOW-FRICTION DEFAULT FLOW)

On first install, **do not ask the user to choose modes**.
Do not present A/B/C onboarding branches.

Default flow is **streamlined**:
Confidence
90% confidence
Finding
The skill explicitly directs the agent to proceed with account registration, token saving, and project search without asking the user when 'safe defaults' exist. That is autonomous decision-making affecting identity, external account creation, and ongoing access credentials, which is dangerous because it removes human consent for security-sensitive actions.

Static analysis

No suspicious patterns detected.