ag-ui-protocol
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines a protocol designed to handle and process untrusted external data, creating an attack surface for indirect prompt injection in systems implementing it.
- Ingestion points: Data enters the agent context through
UserMessagecontent (text and multimodal) andToolMessageexecution results, as documented indocs/2025-11-27/concepts/messages.md. - Boundary markers: The protocol utilizes structured message roles (user, assistant, system, tool, activity, developer) to provide context boundaries.
- Capability inventory: The protocol enables streaming text responses, tool execution, and shared state management via JSON Patch deltas.
- Sanitization: Tool parameters are validated against JSON Schemas to ensure arguments match expected structures, as described in
docs/2025-11-27/concepts/tools.md. - [EXTERNAL_DOWNLOADS]: The documentation references and links to the official AG-UI project repository on GitHub for source code and further reference.
- [COMMAND_EXECUTION]: The quickstart guides provide standard shell commands for project initialization and package installation using
pnpm, common for JavaScript development environments.
Audit Metadata