langchain
Warn
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill documents the creation of tools using 'eval()' to process LLM-generated strings. This allows for arbitrary Python code execution if the LLM is manipulated via prompt injection.
- Evidence: Found in 'SKILL.md' (calculator tool) and 'references/agents.md' (calculator function).
- [DYNAMIC_EXECUTION]: The documentation for the FAISS vector store explicitly enables unsafe deserialization, which uses the 'pickle' module and is vulnerable to arbitrary code execution if the local index file is compromised.
- Evidence: 'references/integration.md' uses 'allow_dangerous_deserialization=True' in the 'FAISS.load_local' call.
- [COMMAND_EXECUTION]: The skill includes documentation for the 'ShellTool' and 'PythonREPLTool', which grant the agent the capability to execute arbitrary shell commands and Python code on the host system.
- Evidence: 'references/integration.md' under 'Tool integrations'.
- [INDIRECT_PROMPT_INJECTION]: The skill's primary focus is RAG (Retrieval-Augmented Generation), which creates a large attack surface for indirect prompt injection by ingesting untrusted data from the web, PDFs, and other external sources.
- Ingestion points: WebBaseLoader, PyPDFLoader, CSVLoader, and DirectoryLoader in 'SKILL.md' and 'references/rag.md'.
- Boundary markers: Generally absent or limited to basic natural language separators in prompt templates.
- Capability inventory: Capability to execute shell commands (ShellTool), evaluate Python (eval, PythonREPLTool), and write to the filesystem (vector store persistence).
- Sanitization: No evidence of input sanitization or filtering for retrieved content before it is passed to the LLM.
Audit Metadata