registry / openclaw-a2a-gateway / 1.5.0

openclaw-a2a-gateway@1.5.0

OpenClaw plugin implementing the A2A (Agent-to-Agent) v0.3.0 protocol — bio-inspired routing, discovery, and resilience for multi-agent ecosystems

AI Security Review

scanned 4h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. A first-party OpenClaw extension starts an A2A gateway at runtime and can communicate with configured peers. No unconsented install-time mutation or concrete malicious behavior was found.

Static reason

No blocking static signals were detected.

Trigger

OpenClaw loads the plugin at startup; configured peer, task, or webhook actions invoke network I/O.

Impact

Exposes configured A2A endpoints and transmits configured task data to configured public peer/webhook URLs.

Mechanism

Runtime A2A service, peer client, and durable task/audit storage.

Rationale

The package is aligned with its declared A2A gateway purpose, but its startup-activated OpenClaw integration and network service constitute an extension lifecycle risk. No evidence supports a malicious verdict.

Evidence

package.jsonopenclaw.plugin.jsonindex.tssrc/client.tssrc/file-security.tssrc/task-store.tssrc/audit.ts~/.openclaw/a2a-tasks~/.openclaw/a2a-audit.jsonl

Network endpoints3

0.0.0.0configured peer agentCardUrlvalidated webhook URL

openclaw-a2a-gateway@1.5.0

AI Security Review

Decision evidence

Source & flagged code

Findings