databricks-apps-python
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill includes code examples for building LLM-integrated applications (e.g., chat interfaces and content evaluators) that ingest untrusted user or external text data.
- Ingestion points: Untrusted data enters via
st.chat_inputinexamples/fm-minimal-chat.pyand via thetextparameter in evaluation functions withinexamples/fm-parallel-calls.pyandexamples/fm-structured-outputs.py. - Boundary markers: While system prompts are used in
examples/fm-structured-outputs.pyto guide model output, explicit delimiters or warnings to ignore embedded instructions are not consistently implemented in the templates. - Capability inventory: The applications have the capability to perform database queries via SQL Warehouse and Lakebase resources, and invoke Model Serving endpoints using the authenticated
WorkspaceClientor user-forwarded tokens. - Sanitization: The provided examples do not demonstrate input sanitization or strict schema validation for the raw data being processed by the LLM, creating a surface for indirect instructions to influence agent behavior.
Audit Metadata