langchain-langgraph-subgraphs
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines state schemas that ingest and propagate message histories (
messages: Annotated[list[AnyMessage], add_messages]) which typically contain untrusted user content. In environments where the agent has access to powerful tools, this data ingestion creates a potential attack surface for indirect prompt injection. - Ingestion points:
ParentStateandExecutorState(defined inSKILL.mdandreferences/state-contract.md) ingest message arrays that can contain external input. - Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are utilized when interpolating or processing message state.
- Capability inventory: The skill metadata in
SKILL.mdspecifies access toRead,Write,Edit, andBash(python:*)tools, which could be targeted by injected instructions. - Sanitization: The implementation patterns do not include sanitization or validation of the message content before it is processed by the graph nodes.
Audit Metadata