senior-ml-engineer
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documents patterns for building LLM and RAG applications that interpolate external, untrusted data into system and user prompts without showing safety guardrails.
- Ingestion points: Untrusted data enters the context via the
user_inputvariable in sentiment classification examples (references/llm_integration_guide.md),product_contextin chat message generation (references/llm_integration_guide.md), and retrieved documentcontentin the RAG pipeline implementation (references/rag_system_architecture.md). - Boundary markers: Code snippets demonstrate prompt construction using simple string formatting (e.g.,
FEW_SHOT_TEMPLATE.format(user_input=text)) without the use of delimiters, XML tags, or explicit instructions for the model to ignore embedded commands within the ingested data. - Capability inventory: While the provided scripts in the
scripts/directory are currently boilerplate skeletons, the skill's purpose is to guide the creation of production systems that call external LLM APIs (OpenAI, Anthropic) and manage vector database operations (Pinecone, Qdrant). - Sanitization: The reference documentation lacks examples or instructions for sanitizing, filtering, or validating external content before it is interpolated into prompts.
Audit Metadata