agy-bridge@0.4.0
CAUTION· startup onlyPublisher claims: "Enables Claude Code to delegate coding work to a team of Google Antigravity specialists, dispatching tasks to particular roles, listing available agents, checking or cancelling task status, and validating delivered work against acceptance criteria and verification commands. It keeps the leader model in control by returning short results with token usage, git change summaries and output tails instead of the full work." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Startup only; authenticated tool behavior not tested.- Tested
- server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
- Not tested
- the tool list (the server exited before answering) · what the tools do when called with real credentials
- Needs
- A2A_API_KEY — give it to the server where it runs, through vet-skills run --secrets, so the value never enters the server's environment. Never paste a credential into a chat, a ticket or a report.
What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
A2A_API_KEYA2A_TOKEN_FILEVITE_A2A_TOKENor--device-authConfiguration, not credentials: A2A_ACCOUNTS_DIR, A2A_API_CHECK_URL, A2A_GOOGLE_USERINFO_URL, A2A_HOME, A2A_HOST, A2A_LEADER_OUTPUT_LIMIT, A2A_LOGS_DIR, A2A_MAX_EVENT_CLIENTS, A2A_PICTURE_HOSTS, A2A_PLUGINS_DIR, A2A_PORT, A2A_PRESETS_DIR, A2A_REAL_HOME, A2A_SETTINGS_FILE, A2A_TEAMS_DIR, A2A_TELEGRAM_INBOX_FILE, A2A_TELEGRAM_POLL_SECONDS, A2A_TELEGRAM_STATE_FILE, AGY_BIN, ANTHROPIC_BASE_URL, ANTHROPIC_DEFAULT_FABLE_MODEL, ANTHROPIC_DEFAULT_HAIKU_MODEL, ANTHROPIC_DEFAULT_OPUS_MODEL, ANTHROPIC_DEFAULT_SONNET_MODEL, ANTHROPIC_MODEL, BASE_PATH, CLAUDE_BIN, CLAUDE_CODE_SUBAGENT_MODEL, CLAUDE_CONFIG_DIR, CODEX_BIN, CODEX_HOME, DEEPSEEK_KEY- Where it talks to
- no vendor host named in the codeAlso t.me, claude.com, deepseek.com, moonshot.ai, kimi.ai, moonshot.cn, kimi.com, z.ai, bigmodel.cn, minimax.io, minimax.cn, minimaxi.com, aliyuncs.com, alibabacloud.com, openrouter.ai, volces.com, volcengine.com, chatgpt.com, groq.com, apple.com, telegram.org — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- no credential files read · no network
- What we could not test
- the tool list (the server exited before answering) · what the tools do when called with real credentials
Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names t.me, claude.com, deepseek.com, moonshot.ai, kimi.ai, moonshot.cn, kimi.com, z.ai, bigmodel.cn, minimax.io, minimax.cn, minimaxi.com, aliyuncs.com, alibabacloud.com, openrouter.ai, volces.com, volcengine.com, chatgpt.com, groq.com, apple.com, telegram.org as well as its own vendor. The guard injects A2A_API_KEY, A2A_TOKEN_FILE, VITE_A2A_TOKEN only into requests to the host you bind (and its subdomains) and refuses the rest.
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-14 and scored it 68/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Image alt text carrying instructions; Privileged sudo command; Prompting user to enter sensitive credentials. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 40 s · 2 scenarios · 0 deviationsStatic findings
API key accounts on the Accounts pageFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.v | /run <role> <prompt>Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.console.log(`[A2A Protocol Server] POST requests need the token in ${security.TOKEN_FILE}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.console.log(` input ${fmt(totals.input_tokens)}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.console.log('Note: it starts when you log in. To start it at boot without logging in, run: sudo loginctl enable-linger $USER');Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.console.log('Registration failed:\n' + result.output + '\n\nRun this yourself:\n\n ' + printable + '\n');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.if (detail.log.trim()) await sendPre(detail.log.slice(-LOG_TAIL_CHARS));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.console.log(` output ${fmt(totals.output_tokens)}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.if (!fs.existsSync(path.join(LOGS_DIR, `${id}.log`))) return sendJson(res, 404, { error: 'Task not found' });Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.| `/run <role>[@account] <prompt>` | Start one agent in the configured workspace (needs "Allow starting work") |Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.if (!trimmed && requireKey) throw new AccountError('Paste the API key', 400);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.console.log(' It starts when you log in. To start it at boot without logging in, run: sudo loginctl enable-linger $USER');Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.console.log(`Tip: Run "a2a logs <taskId> -f" to stream a task's real-time output.\n`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.rules={editing ? [] : [{ required: true, message: "Paste the API key" }]}Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.if (run.review && run.review.output) console.log(`Review:\n${run.review.output}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.Cost to the agent
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.
What would make this Verified
12 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Prompting user to enter sensitive credentials≈ +9 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- Unclaimed publisher≈ +8 on the totalClaim chandara-code: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Hidden instructions≈ +6 on the totalRemove HTML comments, zero-width characters and white-on-white text that carry instructions. Everything the agent is meant to read should be visible to the person reading the file.
- Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
- File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.