Skills/ClawHub/a2a-exposed-setup

a2a-exposed-setup@0.8.61

VERIFIED· install only

Publisher claims: "Use when deploying, redeploying, or configuring the a2a-exposed Cloudflare Worker, a wake webhook, polling, or a public façade for an agent that already speaks A2A, or creating a hosted agent on a2a.exposed. Not for reading or replying to messages (use a2a-exposed)." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher telegraphic-dev · publishing for 11 daysInstalls 756Last detonated 1 h ago
$clawhub install a2a-exposed-setup
WatchReport an issue

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

What changed since 0.8.60

vet-skills diff a2a-exposed-setup 0.8.60 0.8.61

In the sandbox, this version reached for nothing 0.8.60 did not. Compared from the two recorded runs, not from source.

The guard can hold an update like this until someone approves it (runtime.on_change: hold). A change that only shows with a real credential, or on a path the run did not reach, is not in a trace and so not in this comparison.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-15 and scored it 85/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

MEDIUM
npx invocation of non-well-known packageSKILL.md:87 · npx invocation of non-well-known package — may execute untrusted code…eferences/checklist.md) before sign-in or configuration. Run every command as `npx -y a2a-exposed@latest <cmd>` (Node 22.18+; [references/prerequisites.md](reference…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commandSKILL.md:87 · File permission modification command — agent changes file ownership/permissions…ation writes or Cloudflare calls. Config is `~/.config/a2a-exposed/config.env` (chmod 600). A second bot uses its own `A2A_CONFIG_DIR`. For an offline self-hosted pla…Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
npx invocation of non-well-known packageSKILL.md:5 · npx invocation of non-well-known package — may execute untrusted codecompatibility: Node 22.18+ for the CLI (npx -y a2a-exposed@latest, no global install). Without Node, connect https://a2a.exposed/mcp. Cloudflare account for self-hosted deploy.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Authorization escalation languageSKILL.md:108 · Authorization escalation language…. On macOS, service installation needs an admin password at a terminal; without admin access keep `cloudflared tunnel run --token-file <file>` running, or use a user Launch…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
npx invocation of non-well-known packageSKILL.md:95 · npx invocation of non-well-known package — may execute untrusted code…s, `uninstall`, or any other account change, identify the account name/id from `npx cf auth whoami`, explain the concrete resources and secrets being created, changed…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commandSKILL.md:91 · File permission modification command — agent changes file ownership/permissions…ey in chat. The CLI stores the owner token in local `config.env` (keep the file chmod 600; never print it). The hosted MCP connector at `https://a2a.exposed/mcp` is t…Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
npx invocation of non-well-known packageSKILL.md:130 · npx invocation of non-well-known package — may execute untrusted code…failed, the redacted error, and what you tried. Use one of these: - **CLI:** `npx -y a2a-exposed@latest feedback "message"` with `--kind bug|idea|other`, `--steps`,…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageSKILL.md:107 · npx invocation of non-well-known package — may execute untrusted code…ox owner token does not create hosted addresses. For self-hosting, rotate with `npx -y a2a-exposed@latest init --rotate-owner-token` (it says to update `A2A_OWNER_TOK…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
LOW
Authorization escalation languagereferences/wake.md:341 · Authorization escalation language · informational: not an instruction filedo not run it unattended. Without admin access, keepFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01

Cost to the agent

Instructions loaded
≈6,724 tok
1 file · 9 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.