← 返回 Skills 市场

a2a-Market-UCP-Broadcast

Name: a2a-Market-UCP-Broadcast
Author: luoqianchenguni-max

作者 luoqianchenguni-max · GitHub ↗ · v0.2.0 · MIT-0

cross-platform ⚠ suspicious

232

总下载

当前安装

版本数

在 OpenClaw 中安装

/install a2a-market-ucp-broadcast

功能描述

Implement UCP broadcast of buyer intents to eligible nodes, including message signing, routing, and ack handling. Use when building universal commerce protoc...

使用说明 (SKILL.md)

\r \r

a2a-Market UCP Broadcast\r

\r Define the transport and protocol shell for intent broadcast in UCP.\r \r Current status: framework release for registration. Prioritize interoperability contracts over optimization.\r \r

Scope\r

Build intent payload schema and canonical signing routine.\r
Broadcast to eligible nodes and track delivery acknowledgements.\r
Feed response stream into quote intake service.\r \r

Suggested Project Layout\r

app/protocol/ucp/intent_message.py\r
app/protocol/ucp/signer.py\r
app/application/services/broadcast_service.py\r
app/infrastructure/ws/ucp_gateway.py\r \r

Minimum Contracts (MVP P0)\r

build_intent(payload) normalizes and version-tags message.\r
sign_intent(intent, private_key) returns detached signature object.\r
broadcast(intent_id, target_nodes) returns dispatch receipt ids.\r
collect_acks(intent_id, timeout_ms) returns per-node ack status.\r \r

Event Mapping\r

Emit INTENT_CREATED before dispatch.\r
Emit INTENT_BROADCASTED after fan-out completes.\r
Emit NODE_RESPONDED when quote/ack arrives.\r \r

Guardrails\r

Keep canonical JSON serialization deterministic for signing.\r
Record per-node retry counters and stop after configured threshold.\r
Attach protocol version in every envelope.\r \r

Implementation Backlog\r

Add adaptive node selection based on reputation percentile.\r
Add dead-letter handling for nodes with repeated timeouts.\r \r

Runtime Implementation\r

Status: implemented in local runtime package.\r
Primary code paths:\r
runtime/src/protocol/ucp-client.js\r
runtime/src/application/market-agent.js\r
Validation: covered by runtime/tests and npm test in runtime/.\r

安全使用建议

Proceed cautiously. The SKILL.md describes message signing and references a local runtime implementation and tests, but this package contains no code or declared secrets/env vars for private keys. Before installing: (1) ask the publisher to provide the referenced runtime code or a clear install spec; (2) require an explicit, minimal method for providing signing keys (for example, a single declared env var or secret-store path) and documentation for key management; (3) verify the provenance of any external runtime package and review its tests; (4) avoid supplying private keys to the agent directly — prefer a secret store or scoped key with limited privileges; and (5) if you still want to try it, run the implementation and tests in an isolated environment and inspect network behavior to ensure broadcasts go only to intended endpoints. These inconsistencies (missing code and undeclared key handling) are the main reason this is flagged as suspicious.

功能分析

Type: OpenClaw Skill Name: a2a-market-ucp-broadcast Version: 0.2.0 The skill bundle defines a framework for implementing a Universal Commerce Protocol (UCP) broadcast system. The instructions in SKILL.md are focused on standard architectural patterns such as message signing, deterministic JSON serialization, and acknowledgement tracking, with no evidence of malicious intent, data exfiltration, or prompt injection.

能力评估

ℹ Purpose & Capability

Name, description, and SKILL.md goals (intent payloads, signing, broadcast, ack collection) are consistent with a UCP broadcast helper. However the SKILL.md asserts a local 'runtime' implementation and test paths (runtime/src/..., npm test) while this published bundle contains no code or install spec — suggesting either missing artifacts or that the skill depends on out-of-band code.

⚠ Instruction Scope

The instructions specify signing (sign_intent(intent, private_key)) and runtime behavior but do not describe how private keys are stored/obtained, nor do they constrain where the agent should look for code or run tests. That leaves scope for the agent or integrator to locate sensitive keys or external code at runtime without guidance.

✓ Install Mechanism

This is an instruction-only skill with no install spec and no binaries to download or extract — low installation risk. The lack of an install step is coherent with the absence of code, but exacerbates the issue that expected runtime artifacts are missing.

⚠ Credentials

No environment variables, credentials, or config paths are declared, yet core functionality requires signing with a private_key. The skill should declare how signing keys are provided (env var, secret store, config path). The omission is disproportionate and could lead to ad-hoc handling of sensitive keys.

✓ Persistence & Privilege

The skill is not marked always:true and has no install-time persistence; it cannot force inclusion on every agent run. There is no evidence it modifies other skills or system-wide settings.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install a2a-market-ucp-broadcast
安装完成后，直接呼叫该 Skill 的名称或使用 /a2a-market-ucp-broadcast 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v0.2.0

sync runtime implementation and validation coverage

v0.1.0

initial scaffold for early registration

元数据

Slug a2a-market-ucp-broadcast

版本 0.2.0

许可证 MIT-0

累计安装 0

当前安装数 0

历史版本数 2

常见问题