A2a Server

Run an A2A inbound task listener that lets this OpenClaw instance receive tasks from other agents via the A2A API Gateway. Use when: (1) starting/stopping th...

This skill appears to do what it says, but take these safety steps before enabling it: (1) Set A2A_GATEWAY_API_KEY to require bearer auth — leaving it empty disables authentication. (2) Prefer invoking a local openclaw CLI over configuring A2A_OPENCLAW_URL to a remote endpoint unless you trust that endpoint; any configured command or URL will receive incoming message content and metadata. (3) Review and control the A2A_OPENCLAW_COMMAND value (it can execute arbitrary shell commands). (4) Check any shared a2a-client/a2a.conf the skill may read to avoid unintentionally sharing credentials or endpoints. (5) Bind the listener to a restricted interface (e.g., localhost or private IP) and firewall the port if you do not want it publicly reachable. (6) Inspect logs (a2a-listener.log) — they may contain message snippets and metadata. If you want stronger guarantees, keep the listener on an isolated network, or only start it when you explicitly need to receive tasks.

Type: OpenClaw Skill Name: openclaw-a2a-server Version: 1.4.0 The skill implements an inbound task listener that is vulnerable to Remote Code Execution (RCE) via shell injection. In `a2a-listener.py`, the `_invoke_via_command` function constructs a shell command by performing simple string replacement on user-supplied task content and then executes it using `subprocess.run(shell=True)`. While this is designed to allow the agent to process inbound tasks, the lack of proper sanitization allows for command injection. Additionally, the listener can be configured to run without authentication if the `A2A_GATEWAY_API_KEY` is omitted, increasing the risk of unauthorized exploitation.