ap2-credentials-provider
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill directs the agent to fetch documentation and protocol specifications from ap2-protocol.org. It also references the google-agentic-commerce project on GitHub, which is a trusted organization repository, for sample implementations and security topics.
- [INDIRECT_PROMPT_INJECTION]: The proposed architecture involves the agent acting as a Credentials Provider that ingests untrusted data in the form of Payment Mandates and user attestations from external Shopping Agents. \n
- Ingestion points: Payment Mandates and user attestations provided by external Shopping Agents (SKILL.md). \n
- Boundary markers: The instructions do not define specific prompt boundaries or delimiters to isolate ingested data from agent instructions. \n
- Capability inventory: The skill environment is configured with tools such as Bash, Write, Edit, and WebFetch. \n
- Sanitization: While the protocol requires cryptographic verification of mandates and attestations, it does not specify sanitization or filtering for natural language instructions that could be embedded in those fields.
Audit Metadata