databricks-model-serving
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process user-provided message data through serving endpoints, creating a potential surface for indirect prompt injection.
- Ingestion points: Untrusted data is ingested through the
messagesarray in thequerycommand (SKILL.md) and thereq.body.messagesobject in the off-platform streaming reference (references/off-platform-streaming.md). - Boundary markers: The provided implementation examples do not use explicit boundary markers or system instructions to prevent the model from following commands embedded within user input.
- Capability inventory: The skill possesses extensive capabilities including creating, updating, and deleting serving endpoints, as well as accessing build and runtime logs.
- Sanitization: The code snippets pass user input directly to the model serving APIs without demonstrating sanitization or filtering of the content.
Audit Metadata