The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute system commands for environment setup and authentication. \n
scripts/deploy-agent.sh uses pip to install required Python packages. \n
scripts/test-a2a-protocol.py executes gcloud auth print-access-token to obtain credentials for testing.\n- [DATA_EXFILTRATION]: A testing script retrieves a sensitive authentication token and transmits it to a remote endpoint. \n
In scripts/test-a2a-protocol.py, the get_access_token function extracts a Google Cloud access token via the CLI. \n
This token is subsequently included in the authorization headers for HTTP requests sent to an agent_url provided as a command-line argument, creating a pathway for credential exfiltration if the URL is attacker-controlled.\n- [DYNAMIC_EXECUTION]: The deployment script dynamically incorporates external code into the execution environment. \n
scripts/deploy-agent.sh modifies the Python search path using sys.path.insert(0, '${AGENT_DIR}') based on a user-supplied directory argument. \n
It then imports the root_agent from this directory, which allows for the execution of arbitrary code contained within the target directory.\n- [EXTERNAL_DOWNLOADS]: The skill downloads and installs dependencies from external repositories. \n
scripts/deploy-agent.sh installs packages such as google-cloud-aiplatform and google-adk using pip. \n
These downloads originate from well-known official sources related to the skill's primary function of Google Cloud agent deployment.\n- [INDIRECT_PROMPT_INJECTION]: The orchestration patterns described in the skill involve passing data between multiple agents, which constitutes an injection attack surface. \n
Ingestion points: Multi-agent pipelines (e.g., in references/workflow-examples.md) ingest outputs from sub-agents as inputs for subsequent steps. \n
Capability inventory: The skill has access to shell execution (Bash) and network tools. \n
Boundary markers: There are no explicit delimiters or instructions provided in the examples to prevent the agent from interpreting sub-agent output as new instructions. \n
Sanitization: The implementation examples do not demonstrate validation or sanitization of data passed between agents.

adk-deployment-specialist