langchain-tools
Pass
Audited by Gen Agent Trust Hub on Aug 16, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documents the use of external data sources such as Tavily, Wikipedia, and DuckDuckGo search engines. These tools ingest untrusted content from the web into the agent's execution context, which represents a standard indirect prompt injection surface for AI agents.
- Ingestion points: TavilySearchResults, WikipediaQueryRun, and DuckDuckGoSearch classes described in SKILL.md.
- Boundary markers: The documentation does not explicitly show prompt delimiters, but it highlights architectural best practices.
- Capability inventory: The skill documents network access (search APIs, fetch) and database queries.
- Sanitization: The skill actively promotes the use of Zod schemas for parameter validation and structured tool definitions to ensure type safety and input sanitization.
Audit Metadata