A2a Server

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:42 AM UTC
• Version: 0.1.0

Overview

This is a coherent WebSocket agent-messaging skill, but it needs Review because unauthenticated clients can spoof agents and route RPC/pub/sub payloads if the server is reachable by untrusted clients.

Use this only for local, trusted development unless you add authentication, TLS or equivalent transport protection, server-bound agent identities, authorization policies, signed messages, rate limits, payload/queue size limits, and dependency updates. Do not expose the WebSocket port to untrusted networks or send secrets through it as packaged.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: src/server.js:223

Finding

Unauthenticated Agent Identity Takeover and Unauthorized Unregistration

Content

View full analysis

Remediation

View remediation

authenticated agentId` mapping. 4. Reject duplicate active registrations by default. If identity replacement is required, use an authenticated session-revocation process. 5. Require successful registration before processing any operation other than registration and connection negotiation. 6. For unregistration, ignore any client-supplied identity and unregister only the identity bound to the requesting socket. 7. Add authorization policies defining which agents may discover, call, publish to, or subscribe to particular resources. 8. Record security audit events for failed authentication, duplicate registration attempts, identity replacement, and unauthorized operations. 9. Add tests proving that one socket cannot register as, replace, or unregister an identity owned by another authenticated socket. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: src/server.js:298

Finding

Sender Spoofing, Response Injection, and Cross-Agent State Manipulation

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/server.js:122

Finding

Broken Connection Lifecycle Leaves Stale Agent Registrations

Content

View full analysis

{ if (!agentId) { this.log(`⏰ ${clientId} 注册超时，断开连接`); ws.close(4000, 'Registration timeout'); } }, 30000); ws.on('message', (data) => { try { const message = JSON.parse(data.toString()); this.handleMessage(ws, message, clientId); // 注册成功后清除超时 if (message.type === 'register' && !agentId) { clearTimeout(registrationTimeout); } } catch (error) { this.log('❌ 消息解析错误:', error.message); ws.send(JSON.stringify({ type: 'error', error: 'Invalid message format' })); } }); ws.on('close', () => { if (agentId) { this.log(`🔌 Agent 断开：${agentId}`); this.unregisterAgent(agentId); } else { this.log(`🔌 连接关闭：${clientId}`); } }); } ``` ### Technical Analysis The connection-local `agentId` variable is initialized to `null` but is never assigned after successful registration. This creates two related state-management defects: 1. Receipt of any syntactically valid message with `type: "register"` clears the registration timeout, even if registration fails. 2. When a registered WebSocket closes, the close handler sees `agentId === null` and does not remove the corresponding registry entry. As a result, the `agents` map can retain entries whose WebSocket connections are closed. Those stale entries continue to affect discovery, statistics, identity availability, and message routing. The defect also combines with duplicate registration behavior: a stale identity remains registered until another connection replaces it or heartbeat clean ...[truncated 1377 chars]

Remediation

View remediation

` rather than relying only on a mutable closure variable. 3. Clear the registration timeout only when `handleRegister` confirms successful registration. 4. On socket closure, remove the registration only if the registry still associates that identity with the closing socket: ```javascript const agent = this.agents.get(agentId); if (agent && agent.ws === ws) { this.unregisterAgent(agentId); } ``` 5. Clear the registration timeout in the close and error handlers to prevent unnecessary retained timers. 6. Reject multiple registrations on the same socket unless an explicit authenticated identity-change process exists. 7. Add tests confirming that: - Failed registration does not clear the timeout. - Closed connections are removed immediately. - An old displaced socket cannot unregister the newer owner of the same identity. - Registry size remains stable after repeated connection and disconnection cycles. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: src/server.js:547

Finding

Unbounded Aggregate Offline Queues Permit Remote Memory Exhaustion

Content

View full analysis

100) { queue.shift(); } this.log(`📬 消息已队列：${agentId} (${queue.length}条)`); } ``` ### Technical Analysis The implementation limits each destination queue to 100 messages, but it does not limit: - The total number of destination IDs in `messageQueue`. - The aggregate number of queued messages. - The aggregate byte size of queued payloads. - The size or structure of individual messages. - The rate at which a connection can create queues. - The number of queues attributable to one connection or identity. - The lifetime of queues for identities that never register. The destination identifier is attacker-controlled. An attacker can therefore bypass the per-destination limit by using a unique nonexistent destination for every message. Each request creates a new `Map` entry and retains the complete attacker-controlled message in memory. Because call handling does not require registration, even an u ...[truncated 1390 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (28)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The README explicitly shows trust-chain authorization and message signing as not yet implemented while presenting the service as usable for remote agent communication, but it does not clearly warn that authentication and trust protections are absent. This can lead users to deploy an unauthenticated agent messaging bus where any reachable client may register, discover agents, and send RPC or pub/sub traffic, enabling impersonation, unauthorized invocation, and message tampering.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md

node src/server.js

Known Vulnerable Dependency: brace-expansion==1.1.12 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more

High

• Category: Supply Chain
• Confidence: 93% confidence

Finding

brace-expansion 1.1.12 has multiple reported denial-of-service issues involving pathological brace patterns that can trigger excessive CPU or memory consumption. Because it is included transitively through glob/minimatch-style tooling, an attacker who can influence patterns consumed by development or automation tasks could cause hangs or resource exhaustion.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: browserslist==4.28.1 — 2 advisory(ies): CVE-2026-73088 (Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.); CVE-2026-73089 (Browserslist: Unbounded memory growth (no cache eviction) via distinct query res)

High

• Category: Supply Chain
• Confidence: 84% confidence

Finding

browserslist 4.28.1 is reported vulnerable to crashes, prototype writes, and memory growth when given untrusted stats or many distinct queries. In this repository it is a development-time transitive dependency rather than a direct runtime package, which reduces exposure, but build/test processes may still be impacted if attacker-controlled configuration or stats files are consumed.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: js-yaml==3.14.2 — 4 advisory(ies): CVE-2026-84375 (js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources); CVE-2026-59869 (js-yaml: YAML merge-key chains can force quadratic CPU consumption); GHSA-5p4m-2wfm-xmqj (JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026) +1 more

High

• Category: Supply Chain
• Confidence: 91% confidence

Finding

js-yaml 3.14.2 is associated with several CPU-exhaustion issues involving merge keys and complex YAML structures. Even though it is a dev-only transitive dependency here, YAML parsing in tooling is a common attack surface in CI and local automation when configuration files from untrusted sources are processed.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: picomatch==2.3.1 — 2 advisory(ies): CVE-2026-33672 (Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Mat); CVE-2026-33671 (Picomatch has a ReDoS vulnerability via extglob quantifiers)

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

picomatch 2.3.1 is flagged for ReDoS and method-injection issues related to crafted glob patterns and POSIX character classes. Since this package is commonly used for filename matching in test/build tooling, attacker-controlled patterns or file-selection rules could cause excessive processing or incorrect matching behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The title and all surrounding instructional content in this file are written exclusively in Chinese, with no indication that the skill supports other languages or that the locale restriction is intentional and region-specific. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The document explicitly advertises 'A2A 代码可沙箱执行' and '远程代码调用' but provides no warning about integrity, trust boundaries, or the fact that invoking remote code can execute attacker-controlled logic. In the context of an agent skill, this can normalize unsafe delegation and lead operators to connect untrusted agents or run remote functionality without authentication, authorization, or provenance checks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The usage example shows agent discovery followed by remote RPC calls across the network with no warning that discovered agents may be untrusted and that request data will be shared across trust boundaries. Because the same file states trust-chain authorization is not yet implemented, these examples encourage insecure default use of unauthenticated network peers and can expose sensitive prompts, tool inputs, or trigger malicious remote actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README advertises agent registration, message forwarding, publish/subscribe, and RPC capabilities but does not warn users that this skill exposes network communication surfaces and transmits payloads between agents. In a multi-agent environment, operators may deploy it without understanding that it enables remote message exchange and tool-triggering behavior, increasing the chance of unsafe exposure or misuse.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file presents the skill description, instructions, and API usage primarily in Chinese, which effectively imposes a specific language on users. There is no indication that users can select another language or that the skill is intentionally limited to a Chinese-only audience for a documented regional reason.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This file contains extensive natural-language comments, status messages, and CLI output in Chinese, including configuration notes and runtime logs, with no indication that users can opt into another language. Under the language/locale policy, forcing a specific language without user choice is a natural-language policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The disconnect cleanup logic is effectively broken because the local agentId tracked in handleConnection() is never updated after registration. As a result, when a client disconnects, unregisterAgent() is not called from the close handler, leaving stale agent entries and websocket references in the registry until heartbeat cleanup occurs or indefinitely if heartbeat handling is not used correctly. In this server context, that can enable ghost agents, misrouting, resource retention, and inaccurate presence/authorization decisions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This code automatically transmits agent identity, capabilities, and metadata to the server during registration, and similar outbound sends occur for calls, publish, discovery, and heartbeat operations. Although the file has technical comments, it does not provide a user-facing warning, confirmation, or clear disclosure that potentially sensitive data in metadata or payloads will be sent over the network.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The client-side unsubscribe only deletes local handlers and never informs the server to stop delivering the subscription. This can leave stale server-side subscriptions active, causing continued data delivery, privacy leakage, unnecessary resource consumption, and message buildup after a user believes they unsubscribed.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The header claims support for 'Trust chain authorization', but the server accepts arbitrary WebSocket clients, lets them self-assert any agentId, and forwards messages without authenticating identity or enforcing authorization. In an agent-to-agent messaging system, this can mislead integrators into deploying the service as if trust boundaries exist, enabling spoofing, unauthorized registration, message interception via agentId takeover, and unauthorized message routing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

SQP-3 applies to all file types and covers natural-language policy violations such as forcing a specific language without user opt-in. This markdown file presents all operational instructions and status information only in Chinese, with no indication that the skill is region-specific or that alternative language support is available.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

This file contains user-facing natural-language comments and log strings primarily in Chinese, while the surrounding HTML report declares lang="en". That creates a language/locale constraint without any opt-in or indication that the skill is intentionally region-specific.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: @babel/core==7.29.0 — 1 advisory(ies): CVE-2026-49356 (@babel/core: Arbitrary File Read via sourceMappingURL Comment)

Low

• Category: Supply Chain
• Confidence: 86% confidence

Finding

The lockfile pins @babel/core 7.29.0, which the finding identifies as affected by an arbitrary file read issue via sourceMappingURL handling. In this file it appears only as a dev dependency transitively used by Jest/Babel tooling, so exposure is mainly during local development or CI when processing untrusted JavaScript, but it is still a real dependency risk.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: baseline-browser-mapping==2.10.9 — 1 advisory(ies): CVE-2026-45819 (baseline-browser-mapping process termination on invalid input causes denial of s)

Low

• Category: Supply Chain
• Confidence: 72% confidence

Finding

baseline-browser-mapping 2.10.9 is flagged for a denial-of-service condition on invalid input. It is a transitive dev dependency under browserslist tooling, so the practical risk to a deployed a2a-server runtime is limited, but the vulnerable package is present and could affect build or analysis workflows if fed attacker-controlled input.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 23)May include surrounding context.

json

"author": "小蒲萄 (Clawd)",
  "license": "MIT",
  "dependencies": {
    "uuid": "^9.0.0",
    "ws": "^8.16.0"
  },
  "devDependencies": {

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 24)May include surrounding context.

json

"license": "MIT",
  "dependencies": {
    "uuid": "^9.0.0",
    "ws": "^8.16.0"
  },
  "devDependencies": {
    "jest": "^29.7.0",

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 27)May include surrounding context.

json

"ws": "^8.16.0"
  },
  "devDependencies": {
    "jest": "^29.7.0",
    "jest-websocket-mock": "^2.5.0"
  },
  "engines": {

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 28)May include surrounding context.

json

},
  "devDependencies": {
    "jest": "^29.7.0",
    "jest-websocket-mock": "^2.5.0"
  },
  "engines": {
    "node": ">=18.0.0"

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Comments, log messages, and status text throughout the file are written in Chinese, which imposes a language choice on users and operators reading runtime output. There is no indication that the tool is intentionally region-specific or that users can opt into a preferred language.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.