dspy-prompting
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the
dspyPython library from the official package registry. This is a standard dependency for the tool developed by Stanford NLP. - [INDIRECT_PROMPT_INJECTION]: The skill describes pipelines that ingest and process external data, creating an indirect injection surface.
- Ingestion points: Code snippets in
SKILL.md(e.g.,QA,MathProblem,ExtractPerson) process user-providedquestion,problem, andtextfields. - Boundary markers: The examples do not include explicit delimiter-based isolation or specific instructions for the model to ignore embedded commands within the user-provided inputs.
- Capability inventory: The code snippets demonstrate network capabilities for communicating with external LLM providers (Anthropic, OpenAI) and local instances (Ollama).
- Sanitization: The provided examples do not demonstrate input validation or content filtering before the data is processed by the language model.
Audit Metadata