ap2-a2a-extension

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md explicitly instructs the agent to "Fetch live docs" from external public URLs (e.g., https://ap2-protocol.org/specification/ and https://ap2-protocol.org/topics/ap2-a2a-and-mcp/) and to web-search GitHub for reference implementations, meaning the agent will ingest untrusted third-party web content that can directly influence implementation decisions and runtime behavior.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly about adding payment-specific capabilities to agent-to-agent communication: it defines an "AP2 Payment Extension", mandates (Intent/Cart/Payment Mandates) transmitted as DataParts, payment flows (payment method query, payment processing, challenge handling), and a mapping for "Payment processing → A2A task (Merchant → MPP)". These are specific, financial-operation primitives (mandates, payment processing, merchant payment processor interactions and signing) rather than generic tooling. Therefore it provides direct financial execution capability.