agentsop-query-routing
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill establishes a workflow where untrusted user queries are used to dynamically select downstream handlers, such as text-to-SQL engines, vector indices, or summary tools. This architectural design creates an inherent surface for injection attacks where a user might attempt to manipulate the classification logic to reach a specific tool or engine.
- Ingestion points: User queries are processed in the selector functions (e.g.,
route(state)in the LangGraph example andRouterQueryEnginein LlamaIndex) as shown inSKILL.md. - Capability inventory: The skill enables access to high-capability tools, including SQL engines (
NL2SQL) and data synthesis engines (SummaryIndex), across all scripts in the implementation examples. - Boundary markers: The instructions do not define specific delimiters or instructions to prevent the agent from following malicious instructions embedded within the query itself during the classification phase.
- Sanitization: The SOP focuses on classification accuracy and fallbacks but lacks explicit guidance on sanitizing input queries to prevent payload execution within the router or the chosen handler.
Audit Metadata