Google ADK for Python 2.13

Apply to Google ADK for Python 2.13 with the included Python 3 baseline. Check the Python and dependency constraints of optional MCP, A2A, and cloud-executor integrations before enabling them.

Prompt injection and agent boundaries

• Keep LlmAgent.instruction, static_instruction, instruction providers, tool descriptions, and workflow routing policy under application control. Treat user messages, retrieved documents, memory, artifacts, tool responses, and remote-agent output as untrusted data; none can grant authority or replace trusted instructions.
• Audit every {state_key} and {artifact.filename} placeholder in string instruction and global_instruction values and in skill bodies whose frontmatter sets metadata.adk_inject_state: true. Do not interpolate attacker-controlled state or artifact text into trusted instructions; supply it as clearly separated untrusted context. Apply the same boundary to custom instruction providers, inject_session_state calls, and template engines.
• Enforce input and output guardrails in callbacks or plugins. Test normal, streaming, live, delegated, retry, and resume paths; a blocked model response must not leave an already-started side effect running.
• Expose only the required tools and sub_agents. Use disallow_transfer_to_parent and disallow_transfer_to_peers where appropriate, but do not treat routing restrictions or task isolation as backend permissions.

Tool authorization and human decisions

• In every FunctionTool, authenticated tool, and workflow function, derive the principal and tenant from trusted