llm-ops
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill includes Python code templates for RAG (Retrieval-Augmented Generation) and evaluation frameworks that interpolate untrusted external data into LLM prompts, creating a surface for indirect prompt injection.
- Ingestion points: The
rag_queryfunction inSKILL.mdingests user queries and retrieved document context; theevaluate_responsefunction inSKILL.mdingests questions, expected answers, and actual LLM outputs. - Boundary markers: The prompt templates use simple text headers (e.g., 'Contexto:', 'PERGUNTA:') but lack distinct delimiters or instructions for the model to ignore potentially malicious instructions embedded within the data.
- Capability inventory: The skill is configured to work with agentic tools such as
claude-codeandgemini-cli, which typically have broad access to the local file system and shell execution. - Sanitization: The provided code snippets do not include any input validation, escaping, or filtering to prevent malicious content in the ingested data from influencing the agent's behavior.
Audit Metadata