# GSTD A2A Network

[github.com/openclaw/skills](https://github.com/openclaw/skills)

## Trust Assessment

GSTD A2A Network received a trust score of 10/100, placing it in the **Untrusted** category. This skill has significant security findings that require attention before use in production.

SkillShield's automated analysis identified 20 findings: 4 critical, 2 high, 14 medium, and 0 low severity. Key findings include Arbitrary command execution, Suspicious import: requests, Dangerous call: subprocess.run().

The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The LLM Behavioral Safety layer scored lowest at 0/100, indicating areas for improvement.

### Layer Breakdown

| Layer | Score |
| --- | --- |
| Manifest Analysis | 70% |
| Static Code Analysis | 71% |
| Dependency Graph | 37% |
| LLM Behavioral Safety | 0% |

## Behavioral Risk Signals

- **Network Access**: 5 findings  
- **Filesystem Write**: 1 finding  
- **Shell Execution**: 3 findings  
- **Dynamic Code**: 3 findings  
- **Excessive Permissions**: 2 findings

## Security Findings 20

| Severity | Finding | Layer | Location |
| --- | --- | --- | --- |
| CRITICAL | Arbitrary command execution<br>Python shell execution (os.system, subprocess)<br>Review all shell execution calls. Ensure commands are static (not built from user input), use absolute paths, and are strictly necessary. Prefer library APIs over shell commands. | Manifest | skills/gstdcoin/a2a/python-sdk/gstd_a2a/sandbox.py:26 |  
| CRITICAL | Agent Private Mnemonic Exposed via Tool<br>The `get_agent_identity()` tool returns the agent's private mnemonic. If an attacker gains control of the LLM (e.g., via prompt injection), they can call this tool to exfiltrate the agent's full cryptographic identity, including the mnemonic. This would allow the attacker to drain all funds associated with the agent's wallet and impersonate the agent.<br>Remove the exposure of the private mnemonic from `get_agent_identity()`. This tool should only return public information like the wallet address. The agent's mnemonic should be treated as a highly sensitive secret and never exposed externally. | LLM | main.py:30 |
| CRITICAL | Unrestricted Blockchain Transaction Signing<br>The `sign_transfer()` tool allows the agent to cryptographically sign arbitrary blockchain transfer transactions with a user-controlled `to_address`, `amount_ton`, and `payload`. An attacker who can manipulate the LLM's tool calls could instruct the agent to sign transactions that transfer its funds to an attacker-controlled address, leading to complete financial compromise.<br>Implement strict guardrails and human-in-the-loop confirmation for any financial transactions, especially those involving transfers of funds. The LLM should not have unconstrained access to this tool. Consider whitelisting recipient addresses, setting spending limits, or requiring explicit user approval for transactions. | LLM | main.py:90 |
| CRITICAL | Physical Actuation via Outsourced Computation<br>The `outsource_computation()` tool allows the agent to create tasks for other agents, including tasks of type `openclaw-control`. The `examples/openclaw_bridge.py` demonstrates that such tasks can lead to physical actuation of hardware based on user-controlled `command` and `parameters`. An attacker could exploit this by instructing the LLM to create a malicious `openclaw-control` task, potentially causing physical damage or unauthorized actions if an OpenClaw device is connected and processing tasks.<br>Implement strict validation and whitelisting for `task_type` and `input_data` when called by the LLM. Explicitly restrict or require human confirmation for `openclaw-control` tasks. Ensure that any physical actuation commands are thoroughly sanitized and validated against a predefined safe set of operations. | LLM | main.py:97 | 
| HIGH | Dangerous call: subprocess.run()<br>Call to 'subprocess.run()' detected in function 'run_safe'. This can execute arbitrary code.<br>Avoid using dangerous functions like exec/eval/os.system. Use safer alternatives. | Static | skills/gstdcoin/a2a/python-sdk/gstd_a2a/sandbox.py:26 | 
| HIGH | Unsanitized Content Stored in Global Hive Memory<br>The `memorize()` tool allows the agent to store arbitrary `content` in the 'global grid' (Hive Memory). The `gstd_client.py::store_knowledge()` function, which is called by `memorize()`, does not apply any sanitization (like `SovereignSecurity.sanitize_payload()`) to the `content` before storing it. This creates a vector for prompt injection against other agents who might later `recall()` this unsanitized content. Malicious instructions or data could be injected into the shared memory, potentially manipulating other agents' behavior.<br>Apply robust content sanitization and validation (e.g., `SovereignSecurity.sanitize_payload()`) to the `content` parameter before storing it in Hive Memory. Implement content moderation or reputation systems for stored knowledge to prevent the propagation of malicious instructions. | LLM | main.py:139 |
| MEDIUM | Suspicious import: requests<br>Import of 'requests' detected. This module provides network or low-level system access.<br>Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration. | Static | skills/gstdcoin/a2a/python-sdk/gstd_a2a/gstd_client.py:1 |
| MEDIUM | Unpinned Python dependency version<br>Requirement 'requests' is not pinned to an exact version.<br>Pin Python dependencies with '==<exact version>'. | Dependencies | skills/gstdcoin/a2a/requirements.txt:1 |
| MEDIUM | Task Protocol Validation Bypass for Unknown Types<br>The `validate_task_payload()` function in `python-sdk/gstd_a2a/protocols.py` explicitly returns `True` if a `task_type` is not found in the `TASK_SCHEMAS` registry. This means that if an attacker specifies an unknown `task_type` when calling `create_task()` (via `outsource_computation`), the `data_payload` will bypass schema-based validation. While `SovereignSecurity.sanitize_payload()` is still applied, this bypass reduces the overall security posture and could allow more complex prompt injections or malformed data to pass through.<br>Change `validate_task_payload()` to return `False` or raise an error for unknown `task_type`s. All task types should have a defined schema for robust security. Alternatively, implement a default, highly restrictive schema for unknown types. | LLM | python-sdk/gstd_a2a/protocols.py:60 |

## Scan History

### Embed Code

```markdown

```