a2a-server-config
Pass
Audited by Gen Agent Trust Hub on Feb 16, 2026
Risk Level: LOWCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION] (LOW): The skill contains utility scripts (
generate-server.sh,test-transport.sh,validate-config.sh) that perform filesystem and network operations (cp, curl) to manage templates and test connectivity. - [SAFE] (INFO): Robust security practices are integrated, including explicit instructions to avoid hardcoded keys and a validation script that uses regex to detect potential secrets in configuration files.
- [INDIRECT_PROMPT_INJECTION] (MEDIUM): A vulnerability surface exists in
generate-server.shwhere an untrusted user-provided path is passed directly to thecpcommand without sanitization. This could be exploited via indirect injection to overwrite critical system files if the agent is manipulated into specifying a sensitive destination path. Evidence: Ingestion point (output-file argument in generate-server.sh), Boundary markers (Absent), Capability inventory (cp, curl), Sanitization (Absent for file path). - [SAFE] (INFO): Default server templates use permissive configurations (CORS '*' and 0.0.0.0 binding), but these are clearly documented as development defaults with corresponding production hardening instructions.
Audit Metadata