ai-rag-pipeline
Warn
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines a RAG workflow that ingests data from external search tools (Tavily, Exa) and places it directly into the context of an LLM prompt. This creates a surface for indirect prompt injection if the retrieved content contains malicious instructions.\n
- Ingestion points: The skill uses
tavily/search-assistant,exa/search, andtavily/extractto fetch external content from the web.\n - Boundary markers: None. Retrieved search data is concatenated directly into the prompt string without delimiters or instructions to ignore embedded commands.\n
- Capability inventory: The
Bash(belt *)tool permits local command execution and interaction with various remote inference apps.\n - Sanitization: There is no evidence of filtering, escaping, or validation of the content retrieved from search engines before it is sent to the LLM.\n- [DYNAMIC_EXECUTION]: The orchestration scripts provided in the examples use unquoted shell variable expansion to pass retrieved search data into CLI commands.\n
- Evidence: Multiple examples in
SKILL.md(e.g.,belt app run ... --input "{ \"prompt\": \"... $SEARCH\" }") demonstrate this pattern.\n - Risk: If a web search result contains shell-sensitive characters like backticks, semicolons, or command substitutions (e.g.,
$(...)), the local shell may execute those characters during variable expansion, leading to command injection.
Audit Metadata