ag2-mcp

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The skill is an MCP server that exposes an ask tool; at runtime, the MCP client’s message (and optional context) are user-supplied free text that the server forwards into Agent.ask() as the prompt content, so outsider-authored text from any connected MCP client can enter the LLM context.