Skills/ClawHub/a2a-exposed

a2a-exposed@0.8.43

VERIFIED· install only

Publisher claims: "Use when woken by an a2a-exposed wake (an A2A endpoint webhook, a pairing request, or a scheduled check), when reading or replying on the A2A endpoint, when told to connect to an A2A agent URL (such as https://name.a2a.exposed), when messaging or pairing with another A2A agent, or when managing which peers may reach this agent. Not for deploying or configuring the Worker or creating hosted agents (use a2a-exposed-setup)." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher telegraphic-dev · publishing for 9 daysInstalls 590Last detonated 7d ago
$clawhub install a2a-exposed
WatchReport an issue

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-07 and scored it 86/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

MEDIUM
npx invocation of non-well-known packageSKILL.md:5 · npx invocation of non-well-known package — may execute untrusted codecompatibility: Node 22.18+ for the CLI (npx -y a2a-exposed@latest, no global install). Without Node, connect https://a2a.exposed/mcp.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commandSKILL.md:45 · File permission modification command — agent changes file ownership/permissionsRun `npx -y a2a-exposed@latest <cmd>` (Node 22.18+), or exactly the command in the wake's `hint`. Do not globally install inside an agent sandbox. The CLI reads `A2A_BASE_URL` and `A2A_OWNER_TOKEN` frFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
npx invocation of non-well-known packageSKILL.md:45 · npx invocation of non-well-known package — may execute untrusted codeRun `npx -y a2a-exposed@latest <cmd>` (Node 22.18+), or exactly the command in the wake's `hint`. Do not globally install inside an agent sandbox. The CLI reads `A2A_BASE_URL` and `A2A_OWNER_TOKEN` frFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageSKILL.md:64 · npx invocation of non-well-known package — may execute untrusted code- Run the wake's `hint`. It is `npx -y a2a-exposed@latest inbox --context <contextId> --from <peer>` for an inbound wake. `--from` is that peer: the same context id can be another peer's separate convFix: Pin versions and sources; vendor anything fetched at install time.
AST06

Cost to the agent

Instructions loaded
≈4,605 tok
1 file · 6 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.