ai-sdk-ui-v7
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements a chat interface that processes untrusted user data, creating a potential surface for indirect prompt injection attacks where malicious instructions hidden in data could influence the agent's behavior.
- Ingestion points: In
templates/nextjs-api-route.ts, thePOSThandler accepts an array ofmessagesdirectly from the request JSON body. - Boundary markers: The template lacks explicit boundary delimiters (e.g., triple quotes, XML-style tags, or specific instruction headers) to isolate user-provided content from the system
instructionswithin thestreamTextcall. - Capability inventory: The skill is designed to perform network operations by calling the OpenAI API to process the ingested messages.
- Sanitization: There is no evidence of input validation, sanitization, or filtering of the
messagescontent before it is converted to model-compatible messages and sent to the LLM.
Audit Metadata