agent-to-agent
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates a multi-agent environment where agents share a common context file (.a2a-context.json), which acts as a vector for indirect prompt injection. If an agent writes malicious content to the shared context, subsequent agents reading that data may be compromised.\n
- Ingestion points: All agents read from and write to the shared .a2a-context.json file, specifically the
sectionsandconclusionsfields (see references/protocol.md).\n - Boundary markers: The protocol does not mandate the use of input sanitization or explicit delimiters to isolate data from different agents within the context file.\n
- Capability inventory: The framework uses the
Agenttool to spawn sub-agents with dynamically generated prompts, and grants agents access toBashandWritetools (see SKILL.md and references/registry.md).\n - Sanitization: No validation or filtering logic is specified for the messages and findings passed between agents.\n- [DYNAMIC_EXECUTION]: The skill performs dynamic generation of agent instructions by interpolating context and task data into natural language templates for the
Agenttool. The Coordinator and Supervisor patterns described in references/patterns.md and references/operations.md assemble role-playing identities and task descriptions at runtime based on the state of the shared context.
Audit Metadata