llama-index-wiki
Fail
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: CRITICALINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes 455 markdown files containing LlamaIndex documentation. This constitutes a significant attack surface for indirect prompt injection. A malicious or compromised documentation file could contain hidden instructions that attempt to override the agent's behavior.
- Ingestion points: Multiple Markdown files located in the "references/docs/" directory.
- Boundary markers: Absent; the skill instructions do not provide delimiters or warnings for the documentation content.
- Capability inventory: The agent is authorized to execute shell commands and Python scripts (e.g., "python3 scripts/search_docs.py") as part of its documented workflow in "SKILL.md".
- Sanitization: None; the documentation content is treated as authoritative information.
- [COMMAND_EXECUTION]: The workflow defined in "SKILL.md" requires the agent to execute shell commands using a provided Python script: "python3 scripts/search_docs.py". This grants the skill the capability to run code on the underlying system.
- [EXTERNAL_DOWNLOADS]: The documentation files include numerous examples of commands to download data and code from external sources (e.g., "wget", "curl", and "git clone"). While these are intended as developer guides, an autonomous agent might attempt to execute these network operations. The sources are primarily official project repositories or reputable services like TruLens.
Recommendations
- Contains 6 malicious URL(s) - DO NOT USE
Audit Metadata