HTTPS certificate verification is disabled.
Warn
- Code
- suspicious.insecure_tls_verification
- Location
- dist/outbound/tls-fetch.js:19
- Evidence
rejectUnauthorized: false,
Security audit
OpenClaw A2A Plugin
Security checks across malware telemetry and agentic risk
Overview
This is a disclosed A2A peer-messaging plugin that uses Passport/RODiT authentication and scoped local persistence, with no hidden or purpose-mismatched behavior found.
Install this only if you want your agent to send or receive A2A peer messages. Configure inbound authentication before exposing the gateway, protect the NEAR credentials file, avoid allowUnauthenticated and tlsSkipVerify outside controlled environments, and remember that enabled audit logging can store message summaries while tool-invoked file sending can transmit selected local files to peers.
SkillSpector
By NVIDIA
SkillSpector was not run because this plugin release contains no bundled skills.
VirusTotal
61/61 vendors flagged this plugin as clean.
Static analysis
Detected: suspicious.insecure_tls_verification