ai-rag-pipeline
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill demonstrates architectural patterns where untrusted data fetched from external web searches is directly interpolated into prompts for large language models. This creates a surface for indirect prompt injection attacks if the retrieved web content contains malicious instructions.
- Ingestion points: Data from
tavily/search-assistant,exa/search, andtavily/extractis stored in variables (e.g.,$SEARCH,$SEARCH_RESULT,$CONTENT) and placed directly into LLM prompt strings. - Boundary markers: The provided shell templates lack boundary delimiters or explicit instructions for the LLM to ignore any command-like text within the retrieved search results.
- Capability inventory: The skill utilizes
Bash(belt *)to interact with the inference.sh platform, providing a significant capability tier that could be exploited if an injection successfully manipulates agent behavior. - Sanitization: No sanitization, filtering, or validation is performed on the content retrieved from the external URLs before it is processed by the model.
Audit Metadata