| name | agent-card-signing-auditor |
| description | Helps audit Agent Card signing practices in A2A protocol implementations. Identifies missing signatures, weak signing schemes, and revocation gaps that allow impersonation in agent-to-agent trust handshakes. |
A2A Says Signing Is Optional. That's the Problem.
Helps identify gaps in Agent Card signing that allow impersonation, identity spoofing, and unverifiable capability claims in agent-to-agent trust handshakes.
Problem
The A2A Protocol specifies Agent Cards as the primary mechanism for agent identity and capability advertisement. An Agent Card tells other agents: who you are, what you can do, and what trust level you claim. But the A2A spec makes signing optional — "recommended but not required." In an ecosystem where 15-18% of published skills are already confirmed malicious, optional signing means any agent can present any identity and any capability claim with zero verifiable proof. The trust handshake that underpins all A2A interactions is built on a foundation that most implementations don't verify.
What This Checks
This auditor examines Agent Card signing practices across five dimensions:
- Signature presence — Does the Agent Card include a signature field? Many implementations omit it entirely, relying on the marketplace's account verification as a trust proxy. That's a single point of failure — marketplace accounts can be compromised or impersonated
- Signing scheme strength — If a signature is present, which algorithm was used? RSA-1024 and ECDSA with weak curves are no longer adequate for high-stakes agent interactions. Checks against current recommendations (Ed25519, RSA-2048+ with PSS padding)
- Key transparency — Is the signing key published in a verifiable key transparency log or JWKS endpoint? A signature is only as trustworthy as the process by which you obtained the public key to verify it
- Revocation mechanism — Does the signing infrastructure include a revocation path? Signing keys get compromised. An Agent Card signed with a compromised key looks identical to a legitimately-signed one without revocation checking
