langgraph
Fail
Audited by Gen Agent Trust Hub on Apr 15, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The calculator tool implementation uses the eval() function to process expressions generated by the AI model. Evidence: 'return str(eval(expression))'. This allows for arbitrary code execution if the agent is manipulated via prompt injection to generate malicious Python code.
- [COMMAND_EXECUTION]: Through the eval() function, an attacker can execute shell commands or interact with the underlying operating system by importing libraries like 'os' or 'subprocess'.
- [PROMPT_INJECTION]: The skill architecture is vulnerable to Indirect Prompt Injection. 1. Ingestion points: The search tool brings in untrusted data from the web into the message state. 2. Capability inventory: The skill includes a code-executing calculator tool. 3. Boundary markers: No delimiters or explicit instructions are used to separate retrieved search content from system instructions. 4. Sanitization: No input validation or safe evaluation methods (such as ast.literal_eval) are used.
Recommendations
- AI detected serious security threats
Audit Metadata