The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill documents how to build a message-receiving endpoint (/agents/{agent_id}/messages) that passes external content directly to an agent's processing function. This configuration creates a vulnerability surface where a malicious agent could influence another agent's behavior via embedded instructions.
Ingestion points: receive_message endpoint in SKILL.md.
Boundary markers: The code does not demonstrate the use of delimiters or "ignore" instructions for the incoming message content.
Capability inventory: The skill examples include capabilities for database searching, notification sending, and task handoffs.
Sanitization: No input validation or sanitization of the message.content dictionary is shown before it is processed.
[COMMAND_EXECUTION]: The implementation of the Model Context Protocol (MCP) client uses StdioServerParameters to launch mcp_server.py as a subprocess. This is a standard architectural requirement for the Model Context Protocol (supported by Anthropic) but involves local command execution.
[DATA_EXFILTRATION]: The AgentCommunicator performs network POST requests to external URLs retrieved from a registry. This establishes a communication channel to non-whitelisted domains which could be used to transmit agent context or data between different systems during the A2A coordination process.

a2a-protocols