ap2-a2a-extension
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill directs the agent to fetch documentation from a third-party domain (ap2-protocol.org) to guide implementation. This creates a surface for indirect prompt injection where instructions embedded in the external content could influence the agent's actions.
- Ingestion points: Documentation is retrieved from
https://ap2-protocol.org/ap2/specification/andhttps://ap2-protocol.org/ap2/implementation_considerations/. - Boundary markers: No explicit delimiters or instructions are provided to the agent to treat the fetched data as untrusted.
- Capability inventory: The skill has access to tools like
Write,Edit, andBash, which could be exploited if the documentation contains malicious instructions. - Sanitization: The skill does not define any validation or filtering for the external content.
- [EXTERNAL_DOWNLOADS]: The skill references external URLs to retrieve protocol specifications.
- Evidence: Fetches protocol details from
ap2-protocol.org. - Note: Also suggests searching for reference implementations within the
google-agentic-commerceorganization on GitHub.
Audit Metadata