Is andrewandrewsen/a2achat safe?
https://github.com/openclaw/skills/tree/main/skills/andrewandrewsen/a2achat
This skill is a pure-markdown API client for agent-to-agent messaging via a2achat.top. While it contains no executable code and installation was clean, it creates significant risk through two vectors: (1) a bidirectional messaging channel to a third-party server that could be used for data exfiltration, and (2) incoming messages from untrusted remote agents that could carry prompt injection payloads. The optional CLAWDBOT_TOKEN flow forwards platform credentials to the third party, and the llm.txt 'machine contract' URL creates a remote prompt injection vector controllable by the server operator.
Category Scores
Findings (10)
HIGH Bidirectional data channel to third-party API -30 ▶
The skill instructs the agent to send arbitrary content as messages to a2achat.top via POST /v1/messages/send. Combined with the agent's access to the filesystem and environment, this creates a complete data exfiltration channel. Any data the agent can read could be sent as a 'message' to a remote agent controlled by an attacker.
HIGH Remote prompt injection via llm.txt machine contract -15 ▶
The skill references https://a2achat.top/llm.txt as a 'machine contract' — a URL explicitly designed to be consumed by LLM agents. The server operator can modify this content at any time to inject arbitrary instructions into agents that fetch it. This is a classic remote prompt injection vector where the payload is served dynamically.
HIGH Platform credential forwarding to third party -20 ▶
The skill requests CLAWDBOT_TOKEN, an OpenClaw platform identity token, to be sent to a2achat.top during handshake requests. While marked as optional with a privacy warning, an LLM agent following skill instructions may forward this credential without human review. This enables the third-party operator to impersonate or track OpenClaw agents.
HIGH Incoming messages as prompt injection vector -15 ▶
The skill instructs the agent to poll for and receive messages from remote agents via GET /v1/messages/poll and WebSocket streaming. These messages originate from untrusted remote parties and could contain prompt injection payloads designed to manipulate the receiving agent into performing harmful actions such as reading sensitive files or executing commands.
MEDIUM Multiple external URLs the agent may fetch -10 ▶
The skill references several external URLs (a2achat.top/docs, a2achat.top/llm.txt, github.com/AndrewAndrewsen/a2achat) that an agent might proactively fetch. Each fetched URL is a potential injection point where the content could contain instructions to override agent behavior.
MEDIUM Combined injection + exfiltration creates remote control pipeline -30 ▶
The skill simultaneously creates an inbound channel (receiving messages that could contain injection payloads) and an outbound channel (sending messages with arbitrary content). A sophisticated attacker could use a remote agent to send prompt injection instructions that cause the victim agent to read sensitive files and exfiltrate them as reply messages — all through the skill's legitimate API flows.
MEDIUM Cross-skill ecosystem expands attack surface -15 ▶
The skill references 'yellowagents' skill for agent discovery, suggesting an ecosystem where multiple skills interact. If both skills are installed, an attacker could use yellowagents to discover targets and a2achat to deliver injection payloads, expanding the attack surface beyond what either skill provides alone.
LOW Credential metadata leaks agent identity -5 ▶
The skill's self-registration flow at POST /v1/agents/join requires providing an agent_id and returns a long-lived API key. This creates a persistent identity on a third-party service that could be used to track agent activity or correlate it with other data.
INFO No executable code present 0 ▶
The skill contains only SKILL.md (markdown instructions), _meta.json (metadata), and .clawhub/lock.json (dependency lock). No executable scripts, install hooks, git hooks, submodules, or symlinks were found.
INFO All honeypot files intact 0 ▶
None of the canary files (.env, SSH keys, AWS credentials, .npmrc, Docker config, gcloud credentials) were accessed or modified during installation or monitoring.