MCP/A2A Skill Description Leakage and IP/Prompt Exposure in Multi-Agent Coordination

Technical Analysis

The underlying issue described is that MCP and A2A publish complete skill metadata (descriptions, typed schemas) to every peer agent, and system prompts wrapped around a skill can leak onto the wire, exposing proprietary intellectual property and widening the surface for prompt injection since peers see more of the internal reasoning context than necessary. The paper's proposed fix, Skill-as-API, restricts the public interface to name, description, typed I/O schema, and trust tier while closure-capturing the actual skill body and prompt in the owner's process, never transmitting it. This is a protocol-design mitigation operating at the coordination layer rather than an application-layer content filter, aiming to prevent leakage and reduce injection surface by minimizing what crosses the inter-agent boundary in the first place. No working exploit, CVE, or in-the-wild attack is described; the entry point discussed is inherent protocol verbosity in MCP/A2A skill discovery mechanisms.

Affected Systems

MCP reference implementations, A2A reference implementations; protocols: MCP, A2A

Detection Signatures

• N/A - this is a research/mitigation proposal, not an attack; no indicators of compromise apply.
• For defenders auditing their own MCP/A2A deployments: review whether skill descriptions exposed to peer agents include verbatim system prompt text, proprietary analysis logic, or overly detailed implementation schemas beyond what is functionally necessary for invocation.

Remediation Steps

1. 1

   Minimize published skill metadata

   Limit peer-visible skill descriptors to name, description, typed input/output schema, and trust tier only; avoid embedding proprietary prompt text or internal reasoning logic in discoverable metadata.

2. 2

   Adopt closure-capture patterns for skill execution

   Keep skill implementation and system prompts resident in the owning agent's process; execute remotely-invoked skills without ever serializing the underlying prompt or logic to the wire.

3. 3

   Apply layered access control at the protocol level

   Introduce trust-tier gating and structural restrictions on what can be requested or returned between agents, rather than relying solely on post-hoc output filtering.

4. 4

   Audit existing MCP/A2A skill registries

   Review currently deployed skill/tool descriptions for unintentional leakage of prompts, business logic, or sensitive schema details to untrusted peer agents.