base44-sdk
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides instructions for building AI agents and backend functions that ingest external data and have significant execution capabilities, creating a surface for indirect prompt injection attacks.
- Ingestion points: Untrusted data enters the agent context through conversational AI agents (
base44.agents), realtime server rooms (base44.actors), and LLM-driven data extraction from files (integrations.Core.ExtractDataFromUploadedFile). - Boundary markers: The documentation lacks specific examples of prompt delimiters or boundary markers to isolate untrusted data from system instructions, although it provides architectural guidance on separating user and service role scopes.
- Capability inventory: The SDK provides powerful capabilities including database CRUD operations via
base44.entities, email dispatch viaintegrations.Core.SendEmail, and arbitrary API calls throughintegrations.custom.call. - Sanitization: The documentation includes best-practice advice to validate external content, specifically noting that actor payloads are attacker-controlled and must be validated before use (e.g., in
references/actors.md).
Audit Metadata