langchain-vector-stores

Pass

Audited by Gen Agent Trust Hub on Aug 16, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill provides documentation and code examples for standard LangChain vector store integrations using official packages like @langchain/community and @langchain/pinecone.
  • [INDIRECT_PROMPT_INJECTION]: The skill demonstrates the construction of Retrieval-Augmented Generation (RAG) pipelines, which by design ingest external data into the agent's context. While this presents an inherent attack surface for indirect prompt injection, the skill is instructional and does not exhibit malicious behavior.
  • Ingestion points: Untrusted data enters the agent context via vectorStore.similaritySearch and the retriever used in createRetrievalChain (SKILL.md).
  • Boundary markers: The code examples use basic prompt templates to delimit context, though they lack explicit instructions to the agent to ignore potentially malicious content within the retrieved data.
  • Capability inventory: The demonstrated capabilities are limited to vector storage, retrieval, and document management.
  • Sanitization: The skill shows standard LangChain usage without additional input validation or content sanitization layers.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 16, 2026, 12:30 AM
Security Audit — agent-trust-hub — langchain-vector-stores