Security audit

A2WF — Agent-to-Web Framework

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a straightforward A2WF/siteai.json validator and generator, with minor documentation caveats but no evidence of hidden or harmful behavior.

Install this if you want help working with A2WF/siteai.json policies. Be aware that live website checks require fetching public siteai.json files and may create temporary local files; treat the advertised audit command as limited local analysis unless the publisher clarifies or fixes the live-audit documentation.

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: At L019 the validator is described as 'local-only (no network requests)'. However, L029 instructs use of web_fetch for live websites, and L057-L069 describe an audit mode over a website URL that necessarily performs network access. This is an active contradiction in the skill's own documentation about what validation does.

Missing User Warnings

Low

Confidence: 80% confidence
Finding: This markdown file describes operational behavior that writes downloaded `siteai.json` content or user-pasted JSON to a temporary file. Although the behavior is minor and expected for validation, the skill description does not explicitly warn the user that local temp files may be created, which falls under missing disclosure for file writes in markdown guidance.

Static analysis

No suspicious patterns detected.