Catch Unsigned Agent Cards Before They Become Trust Claims

What it does

agent-card-signing-auditor inspects Agent Card metadata across five dimensions: whether a signature field exists at all, which algorithm produced it (flagging RSA-1024 or weak ECDSA curves against current Ed25519/RSA-2048+ recommendations), whether the public key is discoverable via a JWKS endpoint or transparency log, whether any revocation path is configured, and whether key rotation events coincide with capability changes or lack public announcement.

It accepts three input forms: a raw Agent Card JSON object, an agent endpoint URL to fetch and audit, or a set of snapshots for rotation comparison. Output is a structured report with a four-tier risk rating — STRONG, ADEQUATE, WEAK, or UNSIGNED — plus concrete remediation steps such as adding Ed25519 signing, registering keys in a transparency log, or establishing a rotation policy.

Who should use it

Teams running multi-agent systems where agents advertise capabilities through A2A Agent Cards. If your trust handshake currently relies on a marketplace's account verification as its only identity anchor, this auditor checks the protocol layer beneath that assumption. It complements publisher-level identity tools rather than replacing them; the documentation explicitly recommends pairing it with behavioral analysis for comprehensive assessment.

Setup surface

Requires curl and python3 on the host. No environment variables are needed. The skill runs locally against supplied inputs; there is no hosted service or persistent daemon described in the documentation.

Runner test plan

No execution test has been performed. A proposed static review would check that the five audit dimensions map correctly to Agent Card schema fields, that algorithm assessments match published cryptographic guidance, and that the output format renders consistently across the three input modes. Dependency checks would confirm curl and python3 availability. Prompt-injection screening applies because the skill parses untrusted Agent Card JSON from external endpoints. Sandbox validation would verify that fetching an agent URL does not write outside the intended scope. Residual risks include false negatives when signing infrastructure uses non-standard key distribution methods, and the documented inability to detect undisclosed private-key compromise.

Risk notes

Signing establishes verifiable identity, not trustworthiness. A well-formed signed card can still belong to a compromised or malicious agent. The auditor evaluates publicly observable metadata only; it cannot assess key storage practices on the agent's host or confirm the private key holder matches the claimed identity. Treat every finding as one signal among several.

Source links

• Original skill documentation
• Skill listing
• ClawHub registry