id: a2a-agent-card-enum

info:
  name: Google A2A Agent Card - Enumeration
  author: 0x_Akoko
  severity: info
  description: |
    Detected exposed Google Agent-to-Agent protocol agent cards. The agent-card.json file advertises an AI agent's capabilities, supported skills, authentication requirements, and endpoint URLs.
  reference:
    - https://huggingface.co/blog/1bo/a2a-protocol-explained
    - https://github.com/google/A2A
  metadata:
    verified: true
    max-request: 2
  tags: enum,a2a,google,ai,agent,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/.well-known/agent-card.json"
      - "{{BaseURL}}/.well-known/agent.json"

    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_any(body, "\"skills\"", "\"capabilities\"", "\"agent\"")'
          - 'contains(content_type, "application/json")'
        condition: and
# digest: 490a00463044022033fe176c6cb5af4c142643d26b87672debd56d203c6c8a42c761a6422030d1bf02205b8dc828dd376ad83ae84c19a5ceba3f792a0513c9b1d85cc4a6e2f16d3dcf80:922c64590222798bb761d5b6d8e72950