ap2-dev-patterns
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to fetch live documentation and protocol specifications from external URLs (
ap2-protocol.org) and to search for reference architectures on GitHub (google-agentic-commerce). This creates a vulnerability surface where potentially untrusted external content is ingested into the agent's reasoning context. - Ingestion points: The 'Before writing code' section requires the use of
WebFetchandWebSearchto retrieve content from external domains. - Boundary markers: No explicit delimiters or instructions to ignore embedded commands within the fetched documentation are provided.
- Capability inventory: The skill possesses powerful capabilities including
Bash,Write, andEditwhich could be manipulated if the external documentation contained malicious instructions. - Sanitization: There are no specified mechanisms for validating or sanitizing the data retrieved from external sources.
- [EXTERNAL_DOWNLOADS]: The skill relies on fetching documentation and sample implementations from external sources.
- The instructions include fetching specifications from
ap2-protocol.organd searching for samples within thegoogle-agentic-commercerepositories on GitHub to provide up-to-date context for architectural decisions.
Audit Metadata