a2a

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly fetches remote AgentCards from open HTTP endpoints (e.g., requests.get(f"{url}/.well-known/agent.json") in "A2A Client Testing" and RemoteA2aAgent(agent_card=leaf_url) in SKILL.md), which are untrusted third-party agent.json files that the system reads and uses to create clients, route transfers, and drive agent actions.