piiiico/a2a-trust-audit-action

A2Acommunity
piiiicoMITUpdated 2mo agoGitHub

Audit your A2A agent card across L1-L4 trust dimensions on every PR. GitHub Action wrapping @agentlair/a2a-trust-audit.

Audit your A2A agent card across L1–L4 trust dimensions on every PR. Catches the moment your card silently regresses from B to F. Embed a live trust grade in your README — no CI required: Encode your card URL: Paste the output into the badge URL. The badge re-audits hourly. The A2A protocol has standards for identity (L1) and authorization (L3). It has nothing for behavioral trust (L4). This…

Automatically indexed from public sources. Not yet verified by the developer on Forge.Claim this listing →
2mo agoLast update
Package
Authorpiiiico
LicenseMIT
Sourcegithub
GitHubpiiiico/a2a-trust-audit-action
Trust Status
B
60/100Good
✓Listed in Forge index+10/10
—Publisher identity verified+0/30
→ Publisher: run `forge publish` from the repo to claim ownership
—Domain verification+0/10
→ Not currently available for this listing type — the domain-verification check only runs for npm-backed packages today, so this row cannot be earned here yet regardless of what's hosted at the domain.
✓Prompt-injection scan · clean+30/30
✓Obfuscation / exfil scan · clean+20/20
Paste into Claude Code, Cursor, or any AI assistant to fix all gaps
StatusCommunity-indexed
PublisherUnverified
SignatureUnsigned
Domain—
Provenance—
DependenciesNot audited
Tool surface—
Security scan✓ CleanvHEAD · 2mo ago
EvalsNone
IndexedJun 13, 2026

Verification confirms publisher identity (repo ownership), not code safety. The security scan covers known CVEs and suspicious install scripts — it cannot prove the absence of malicious code.

About

Audit your A2A agent card across L1–L4 trust dimensions on every PR. Catches the moment your card silently regresses from B to F. Embed a live trust grade in your README — no CI required: Encode your card URL: Paste the output into the badge URL. The badge re-audits hourly. The A2A protocol has standards for identity (L1) and authorization (L3). It has nothing for behavioral trust (L4). This action grades your card on all four layers — including the one nobody else checks — and posts the result…

Keywords
a2aagent-cardagent-trustagentlairauditgithub-action