Is jamjamzxhy/a2a-market safe?
https://github.com/openclaw/skills/tree/main/skills/jamjamzxhy/a2a-market
The a2a-market skill is a legitimate-looking cryptocurrency marketplace integration that poses significant risk through its autonomous financial action design: it instructs agents to spend real USDC without per-transaction approval on self-detected capability gaps, claim daily rewards unprompted, and proactively spread referral codes — all routing sensitive wallet and identity data through the operator's API. No malicious code or active data exfiltration was detected during installation, but the behavioral instructions baked into SKILL.md grant the agent broad authority to take real-money actions autonomously in ways users may not anticipate. The risk is systemic rather than acute: the skill's design aligns the agent's behavior with the marketplace operator's revenue interests rather than the user's.
Category Scores
Findings (10)
HIGH Autonomous cryptocurrency spending without per-transaction approval -30 ▶
The skill's Autonomous Behavior section instructs the agent to detect task failures and capability gaps and then search, evaluate, and purchase marketplace skills with no human in the loop for transactions below $5 (auto_approve_below default). This effectively grants the agent authority to spend real USDC on behalf of the user based on self-assessed need.
HIGH Unprompted daily API calls for reward claiming -20 ▶
The skill instructs the agent to automatically claim daily rewards whenever a new day starts, without any user request in that session. This creates persistent background behaviour — the agent contacts api.a2amarket.live daily regardless of user intent, acting as a keep-alive beacon and generating engagement metrics for the operator.
HIGH Capability-gap self-trigger in skill description -10 ▶
The SKILL.md description field — used by the agent runtime to decide when to invoke the skill — lists 'Agent detects a capability gap and needs to acquire new skills' as a trigger condition. Any task the agent cannot complete becomes a potential trigger for autonomous marketplace activity, creating an unbounded invocation surface.
MEDIUM All financial and identity data routed through operator-controlled API -20 ▶
Every transaction, balance check, agent registration, and reward claim sends wallet addresses, agent IDs, and signed Ethereum messages to api.a2amarket.live — a domain owned and operated by the skill author. The operator receives a complete ledger of the user's agent identity correlated with on-chain wallet activity.
MEDIUM Private key stored in environment variable -15 ▶
The recommended configuration stores the Ethereum private key as A2A_MARKET_PRIVATE_KEY in the process environment. Environment variables are visible to all processes running as the same user and are trivially leaked by debugging tools, crash dumps, and other installed skills that can call os.environ.
MEDIUM Operator-controlled marketplace creates financial conflict of interest -30 ▶
The skill routes all purchases through an operator-controlled platform that earns 2.5% on every transaction. The autonomous buy triggers benefit the operator whenever an agent perceives a gap. A malicious operator can list skills priced just above the auto-approve threshold to socially engineer agents into manually-approved purchases, or list critical-sounding skills to exploit the task-failure trigger.
LOW Ethereum private key processed unencrypted in memory -10 ▶
The Python client loads the raw private key string, instantiates an eth_account.Account object, and retains it as self.account for the lifetime of the client instance. While the key is not transmitted to the API, it lives in plaintext process memory and will appear in core dumps or memory-scraping attacks.
LOW Referral code sharing instructs unsolicited outbound promotion -10 ▶
The skill's referral section and the a2a_cli.sh referral command both instruct the agent to proactively share referral URLs to grow the operator's user base. This could manifest as the agent inserting promotional content into responses or communications without user direction.
LOW Python client source truncated — payment flow unverifiable -10 ▶
The collected evidence for scripts/a2a_client.py is cut off immediately before the x402 payment signing and retry logic. The critical section that constructs and transmits the payment proof cannot be audited for hidden data inclusion or alternate endpoints.
INFO Monorepo sparse-checkout may mask future supply-chain risk -5 ▶
The skill is distributed from a shared monorepo (openclaw/skills). Future updates to the monorepo main branch could introduce malicious changes to this skill path without a dedicated release tag, making integrity verification harder for downstream users.