a2a-multi-agent
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements an orchestration layer that ingests external data, creating a surface for indirect injection attacks.
- Ingestion points: The skill ingests untrusted input through the
/a2a/tasksand/a2a/orchestrateendpoints where natural language task descriptions are provided, and through the discovery of remote agents viadiscovery.js. - Boundary markers: The documentation does not specify the use of delimiters or 'ignore' instructions for processed data to prevent the agent from following commands embedded within task descriptions or external agent data.
- Capability inventory: The orchestrator (in
orchestrator.js) can execute 154 different MCP tools throughbridge.jsand delegate tasks to remote network endpoints via outbound requests. - Sanitization: There is no mention of input sanitization, schema validation, or filtering of content received from external agents before it is processed by the agent.
- [COMMAND_EXECUTION]: The skill provides instructions for starting a local Express HTTP server using Node.js to handle task delegation and agent card hosting.
Audit Metadata