google-adk-python

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In the FastAPI/Flask/Slack/PubSub UI integration examples, the agent ingests outsider-authored free text directly from incoming requests/events (e.g., request.message, event["text"], or data["query"]) into types.Part(text=...) that is then passed to runner.run_async()/runner.run(), without requiring any prior selection of a specific trusted item.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The docs include runtime calls that connect to remote MCP servers (MCPToolset.from_url("http://mcp-server:8080") and MCPToolset.from_sse("http://mcp-server:8080/sse")), which at runtime fetch remote tool definitions/capabilities that directly influence the agent's behavior and tool invocation decisions.