registry / @perkos/perkos-a2a / 0.12.17

@perkos/perkos-a2a@0.12.17

A2A Protocol communication plugin for OpenClaw — Agent-to-Agent protocol implementation

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. When loaded as the configured OpenClaw extension, the package starts a network-facing A2A service and forwards received task text into agent-runtime system events. Its fallback persists the same task text in the OpenClaw workspace; optional configured features also deliver task content to PerkOS LLM services.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

OpenClaw loads `dist/index.js` or a user starts a packaged CLI, then a peer sends an A2A task.

Impact

An unauthenticated-by-default reachable endpoint can cause the host agent to process attacker-controlled task text; risk depends on host exposure and plugin configuration.

Mechanism

Network task-to-agent prompt injection with optional workspace and LLM delivery.

Rationale

Source inspection does not support the scanner's malicious remote-decode/execute claim, but it confirms a real network-to-agent control surface with optional authentication. This is a dangerous extension capability rather than demonstrated malicious behavior.

Evidence

package.jsondist/index.jsdist/server.jsdist/runtime-reply.jsscripts/hermes/install.mjs~/.openclaw/workspace/memory/a2a-task-<task-id>.md

Network endpoints4

api.llm.perkos.xyzapp.perkos.xyz/api/agentswss://chat.perkos.xyz/chat

@perkos/perkos-a2a@0.12.17

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code