plugin-openclaw — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited plugin-openclaw (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Enables Clawdbot to communicate with other AI agents via the A2A (Agent-to-Agent) protocol.
This plugin allows bidirectional communication between Clawdbot and other A2A-compatible agents (like MarketClaw). Messages flow both ways:
Add to your Clawdbot config:
channels:
a2a:
enabled: true
agentId: nova # Our identifier (default: openclaw)
agentName: Nova # Display name
bridgeUrl: ws://localhost:8080/a2a # A2A bridge/hub (optional)
agents: # Direct agent connections (optional)
- id: marketclaw
url: ws://localhost:7891/a2a
name: MarketClaw
auth:
token: secret-token # Auth token (optional)
reconnectIntervalMs: 5000 # Reconnect delay (default: 5000)
requestTimeoutMs: 300000 # Request timeout (default: 5 min)Messages follow this format (compatible with MarketClaw's A2A implementation):
interface A2AMessage {
type: 'message' | 'response' | 'chunk' | 'status';
taskId: string; // UUID for request/response matching
contextId?: string; // Optional conversation thread
from?: string; // Sender agent ID
content?: {
parts: [{ kind: 'text', text: string }]
};
status?: 'working' | 'completed' | 'failed' | 'canceled';
error?: string;
}The plugin registers an a2a_agents tool for interacting with connected agents:
// List connected agents
{ action: 'list' }
// Returns: { agents: [{ id, name, connected }] }
// Send message to agent (MUST use full agent ID, not name!)
{ action: 'send', agentId: 'agent-70153299', message: 'What stocks are trending?' }
// Returns: { success: true, response: { text, status, from } }The agentId parameter must be the full agent ID (e.g., agent-70153299), not the friendly name (e.g., marketclaw).
If you only know the agent's name, use discovery first:
gopherhole discover search "<name>"
# Example: gopherhole discover search "marketclaw"
# Output includes: agent-70153299 | FREE | uncategorizedWorkflow:
a2a_agents send directlygopherhole discover search "<name>" to get the IDa2a_agents send with the full IDKnown agent IDs (for reference):
agent-70153299agent-9a2fb7a8
## Files
- `index.ts` - Plugin entry point, registers channel + tool
- `src/channel.ts` - Channel plugin implementation
- `src/connection.ts` - WebSocket connection manager
- `src/types.ts` - TypeScript interfaces
## Building
cd ~/clawd/extensions/a2a npm install npm run build
## Notes
- WebSocket connections auto-reconnect with exponential backoff
- Each message gets a unique `taskId` for request/response correlation
- `contextId` can be used to maintain conversation threads
- The plugin announces itself to connected agents on connect~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.