langchain4j-rag-implementation-patterns

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill implements patterns for ingesting untrusted data from the filesystem and external URLs into the agent's context window. This creates a surface for indirect prompt injection, where malicious instructions hidden in processed documents could influence the agent's behavior during RAG tasks.
  • Ingestion points: Untrusted data enters the context via FileSystemDocumentLoader in SKILL.md and references/examples.md, and via UrlDocumentLoader in references/references.md.
  • Boundary markers: While the skill uses @SystemMessage to define the assistant's role, it lacks robust delimiters or explicit instructions for the model to ignore potential commands embedded within the retrieved context segments.
  • Capability inventory: The skill is configured to allow Read, Write, and Bash tools, granting significant system interaction capability if the agent is manipulated.
  • Sanitization: There is no evidence of text sanitization, filtering, or input validation performed on the ingested document content before it is passed to the language model.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 09:08 PM
Security Audit — agent-trust-hub — langchain4j-rag-implementation-patterns