bigquery-ai-ml
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documentation includes examples of processing untrusted data (such as user reviews, emails, and news articles) using LLM-backed SQL functions like
AI.AGG,AI.GENERATE, andAI.CLASSIFY. Several code examples interpolate user-controlled data directly into prompts (e.g.,'Summarize this article: ' || article_contentinreferences/ai_generate.md) without employing robust boundary markers or sanitization techniques. This establishes an attack surface where malicious data could potentially influence the model's instructions or attempt context exfiltration. - Ingestion points: Data enters the agent context through table columns such as
review(references/ai_agg.md),content(references/ai_classify.md), andarticle_content(references/ai_generate.md). - Boundary markers: Most examples use simple string concatenation; explicit delimiters or instructions to ignore embedded commands are generally absent.
- Capability inventory: The skill facilitates SQL query execution and LLM inference, including semantic aggregation and structured data extraction.
- Sanitization: There is no evidence of input validation, escaping, or filtering of the external data before it is processed by the AI functions.
Audit Metadata