Skill

A2AAgent supports WithTransferStateKey(...) to forward specified runtime state keys via A2A metadata, and supports arbitrary per-request HTTP headers via WithA2ARequestOptions/WithRequestHeader, including an explicit Authorization: Bearer ... example.; A2AAgent can send invocation.Session.UserID using a configurable HTTP header (default X-User-ID), which can expose identity depending on network visibility.

Artifact.Artifact.Data holds arbitrary bytes, and docs explicitly describe user: namespaced artifacts for cross-session persistence, creating risk of sensitive-data retention if sensitive inputs are stored under user: keys.

Example uses claudecode.WithExtraArgs("--permission-mode", "bypassPermissions"), which weakens permission enforcement for the local Claude Code CLI execution.