a2a-push-notifications
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest external content which could be manipulated to influence agent behavior.
- Ingestion points: The skill directs the agent to fetch documentation from
https://a2a-protocol.org/latest/specification/and perform web searches on GitHub for implementation details. - Boundary markers: The instructions lack explicit delimiters or warnings to ignore potentially malicious instructions embedded within the fetched content.
- Capability inventory: The agent has access to powerful tools including
Bash,Write, andEdit, which could be exploited if the fetched data contains malicious commands disguised as documentation. - Sanitization: There is no requirement or guidance for the agent to sanitize or validate the content received from external sources.- [DATA_EXFILTRATION]: The skill initiates network requests to domains outside the standard whitelist.
- Network operations: The skill uses
WebFetchto accessa2a-protocol.org. While this is intended for documentation retrieval, it represents a network connection to a third-party domain.
Audit Metadata