ag2-middleware
Pass
Audited by Gen Agent Trust Hub on Jul 4, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The middleware system introduces surfaces for indirect prompt injection by allowing interception and modification of untrusted data.
- Ingestion points: The
on_turn,on_llm_call,on_tool_execution, andon_human_inputhooks inSKILL.mdprocess external data from LLMs and human users. - Boundary markers: The provided examples do not demonstrate the use of delimiters or 'ignore' instructions when processing intercepted content.
- Capability inventory: The framework supports logging, retries, history trimming, and arbitrary mutation of tool arguments or prompts.
- Sanitization: The documentation does not specify default sanitization or validation routines for content modified via middleware hooks.
Audit Metadata