ai-rag-pipeline
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and downloads components from the official GitHub repository of
inference-sh, which is the primary service provider for the tools described. - [COMMAND_EXECUTION]: The skill is designed to interact with the
beltCLI tool to execute web searches, content extraction, and LLM inference tasks. - [DYNAMIC_EXECUTION]: Shell scripts within the skill dynamically assemble prompt strings by concatenating user queries and retrieved web data, which are then passed as arguments to the CLI tools.
- [INDIRECT_PROMPT_INJECTION]: The skill creates a vulnerability surface by ingesting untrusted data from external websites and feeding it directly into LLM context windows.
- Ingestion points: External data enters the agent context via
tavily/search-assistant,exa/search, andtavily/extracttools as shown inSKILL.mdexamples. - Boundary markers: The prompt templates use basic text labels (e.g.,
Search Results:,Source 1 (Tavily):) to delimit external content, but these offer limited protection against adversarial content designed to look like instructions. - Capability inventory: The skill uses network-enabled tools (
belt) that can both read from the web and send processed data to external LLM providers (OpenRouter). - Sanitization: There is no evidence of filtering, escaping, or validation of the retrieved web content before it is interpolated into the prompts for Claude, GPT-4, or Gemini.
Audit Metadata