Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
What This Skill Does
Audits Agent Card signing practices in A2A protocol implementations. Checks for missing signatures, weak cryptographic schemes, absent key transparency logs, and missing revocation mechanisms. Produces a risk rating and specific remediation recommendations.
A2A signing is optional by spec, so most implementations skip it — this auditor systematically surfaces those gaps before they become impersonation vectors.
When to use it
- Verifying an agent's identity before trusting its capability claims
- Detecting unsigned Agent Cards in an A2A deployment
- Auditing signing algorithm strength across a fleet of agents
- Checking revocation infrastructure before a high-stakes agent interaction
- Comparing Agent Card snapshots to spot suspicious key rotation events
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Audit the Agent Card for data-processing-agent.example
- 1Fetches the Agent Card from the agent endpoint URL
- 2Checks for presence of a signature field in the card
- 3Evaluates the signing algorithm against current recommendations (Ed25519, RSA-2048+ with PSS padding)
- 4Looks up the signing key in the referenced JWKS endpoint or key transparency log
- 5Checks for a revocation endpoint or CRL/OCSP equivalent in the card metadata
Signing audit report with risk rating (UNSIGNED), per-dimension findings for presence, scheme, transparency, and revocation, plus prioritized remediation steps