ag2-a2a

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The skill’s runtime path for consuming a remote A2A agent (A2AConfig with card_url) fetches outsider-authored free text from the remote party’s /.well-known/agent-card.json (and then uses the declared interface/metadata to drive requests), which can include arbitrary descriptions/prompts that get ingested into the client’s LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's A2A client fetches a remote AgentCard at runtime from {card_url}/.well-known/agent-card.json (e.g. http://localhost:8000/.well-known/agent-card.json), and that fetched card is used to select transports/skills and drive the agent's behavior, so remote content can directly control the agent.