← 返回 Skills 市场

A2A Marketplace

Name: A2A Marketplace
Author: paparusi

作者 Lê Minh Hiếu · GitHub ↗ · v2.0.0

cross-platform ⚠ suspicious

547

总下载

当前安装

版本数

在 OpenClaw 中安装

/install a2a-marketplace

功能描述

AI tool marketplace via AgentForge — discover, compare, and execute tools with automatic billing and trust scoring.

使用说明 (SKILL.md)

A2A Marketplace (AgentForge)

Use the AgentForge marketplace tools to discover, evaluate, and execute AI tools from a curated marketplace.

Quick Start

Search for tools:

Use forge_discover to find a tool for "sentiment analysis"

Execute a tool:

Use forge_execute with toolId "tool-abc" and input { "text": "Hello world" }

Available Tools

Tool	Description
`forge_discover`	Search marketplace by query, category, price, trust score, tags
`forge_execute`	Execute a tool (billing applied automatically)
`forge_get_schema`	Get input/output schema for a tool
`forge_balance`	Check agent balance, spending, and tier
`forge_list_categories`	List all tool categories
`forge_batch_execute`	Execute up to 10 tools in parallel

Workflows

Find the best tool for a task

Use forge_discover with your query and optional filters (category, maxPrice, minTrustScore)
Use forge_get_schema to understand the input format
Use forge_execute to run the tool

Budget-conscious execution

Use forge_balance to check remaining budget
Use forge_discover with maxPrice filter
Compare tools by trust score and price
Execute with confidence

Batch processing

Use forge_batch_execute to run multiple tools at once:

{
  "calls": [
    { "toolId": "sentiment-v2", "input": { "text": "Great product!" } },
    { "toolId": "translate-en-vi", "input": { "text": "Hello world" } }
  ]
}

Trust Scores

Tools are scored 0-100 based on:

Uptime and reliability
Response time
User ratings
Security audit status
API compliance

安全使用建议

This skill looks like a legitimate marketplace plugin, but several red flags mean you should verify a few things before installing: - Confirm package provenance: locate the @a2a/openclaw-plugin package on a trusted registry or source (npm page, GitHub repo) and review its maintainer, README, and recent releases. Do not install an unpublished/unknown package without review. - Ask how authentication and billing are handled: the SKILL.md mentions automatic billing and balance checks but provides no instructions for supplying API keys, account tokens, or payment methods. Ensure you understand what credentials will be used and where they are stored. - Understand data flows: tools executed via this marketplace will receive the inputs you provide. If you will pass sensitive data, confirm vendor privacy, permitted data retention, and whether you can limit or redact data before execution. - Verify safeguards: check for budget limits, spending alerts, or an explicit opt‑in per execution to avoid unexpected charges. - Test in a safe environment: if possible, run trial calls with non-sensitive inputs and minimal budget, and monitor network/requests during plugin installation. If you cannot verify the plugin's source, authentication method, and billing controls, consider not installing or request a vendor-provided security/privacy document before proceeding.

功能分析

Type: OpenClaw Skill Name: a2a-marketplace Version: 2.0.0 The skill bundle is benign. The `SKILL.md` file defines an AI tool marketplace with various `forge_*` tools and instructs the agent to install a Node.js plugin `@a2a/openclaw-plugin`. While external dependencies always carry a supply chain risk, the instruction itself is a standard way to extend functionality, and the package name appears legitimate for the stated purpose. There is no evidence of prompt injection attempts, data exfiltration, malicious execution, persistence mechanisms, or obfuscation within the provided files.

能力评估

ℹ Purpose & Capability

Name, description, and runtime instructions consistently describe an AI tool marketplace (discover, get schema, execute, check balance). The single declared install (npm package @a2a/openclaw-plugin) is coherent with providing marketplace functionality. However, the SKILL.md does not document how authentication, account linking, or billing credentials are provided even though the skill describes automatic billing and balance checks—this is an unexplained omission.

⚠ Instruction Scope

Instructions limit the agent to marketplace actions (forge_discover, forge_execute, etc.) and do not request unrelated files or env vars. But the workflow explicitly executes third‑party tools with automatic billing; that implies sending user inputs to external tool providers and financial operations. The SKILL.md gives no guidance on what data may be transmitted, how billing is authorized, or how to limit/exclude sensitive data—this broadens the runtime impact beyond a simple query tool.

⚠ Install Mechanism

The install is an npm package (@a2a/openclaw-plugin), which is a plausible mechanism for this functionality. However, there is no homepage or source repository listed in the skill metadata, so the package provenance is unknown. Installing an unvetted npm plugin can execute arbitrary code; the manifest provides no verification steps or alternative trusted sources.

⚠ Credentials

The skill declares no required environment variables or primary credential, yet it offers balance checks and automatic billing. A marketplace plugin typically needs account credentials, API keys, or payment tokens; the absence of any declared auth mechanism is an inconsistency. That could mean the plugin expects implicit platform-level credentials (not documented) or that necessary secrets/permissions are being omitted from the manifest.

✓ Persistence & Privilege

The skill does not request always:true and defaults for autonomous invocation are unchanged. It does not declare config paths or system-wide modifications. Those properties are proportionate; however, autonomous invocation combined with billing-capable marketplace operations increases impact if provenance/auth are unclear.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install a2a-marketplace
安装完成后，直接呼叫该 Skill 的名称或使用 /a2a-marketplace 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v2.0.0

Initial release — AgentForge AI tool marketplace with 6 tools

元数据

Slug a2a-marketplace

版本 2.0.0

许可证 —

累计安装 0

当前安装数 0

历史版本数 1

常见问题

A2A Marketplace 是什么？

AI tool marketplace via AgentForge — discover, compare, and execute tools with automatic billing and trust scoring. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 547 次。

如何安装 A2A Marketplace？

在 OpenClaw 或 Claude Code 对话框中运行命令「/install a2a-marketplace」即可一键安装，无需额外配置。

A2A Marketplace 是免费的吗？

是的，A2A Marketplace 完全免费（开源免费），可自由下载、安装和使用。

A2A Marketplace 支持哪些平台？

A2A Marketplace 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。

谁开发了 A2A Marketplace？

由 Lê Minh Hiếu（@paparusi）开发并维护，当前版本 v2.0.0。