The Agent Skills Directory

[Data Exposure & Exfiltration] (MEDIUM): The asynchronous executor template for TypeScript implements a callback mechanism that sends task results to an arbitrary URL provided in the task's metadata without any validation or whitelisting. Evidence: templates/async-executor.ts (lines 172-184) performs a fetch POST request to a callbackUrl sourced directly from task.metadata. Risk: This functionality allows for the exfiltration of sensitive task results (such as LLM outputs or processed file data) to external attacker-controlled servers and enables Server-Side Request Forgery (SSRF) attacks against internal network resources.
[Prompt Injection] (LOW): The skill's architecture is vulnerable to indirect prompt injection (Category 8). 1. Ingestion points: A2ATask parameter and metadata objects in templates/async-executor.ts, templates/async-executor.py, and templates/streaming-executor.py. 2. Boundary markers (absent): No delimiters or instructions are used to distinguish untrusted parameters from system instructions. 3. Capability inventory: Network access via fetch, simulated file processing, and LLM inference. 4. Sanitization (absent): The provided templates do not include validation, escaping, or filtering for input URLs or data payloads.

a2a-executor-patterns