building-ai-agent-on-cloudflare
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The provided agent templates ingest untrusted data from user messages and interpolate it directly into AI prompts, creating a surface for indirect prompt injection attacks. \n
- Ingestion points: The
onMessagehandler inSKILL.mdand thehandleChatWithToolsmethod inreferences/agent-patterns.mdreceive messages directly from WebSocket connections. \n - Boundary markers: There are no explicit boundary markers or delimiters (such as XML tags or unique separators) used in the prompt construction to isolate user-supplied content from system instructions. \n
- Capability inventory: The agents have the ability to perform network requests (
fetch), execute SQL queries (this.sql), and schedule background tasks (this.schedule), which could be abused if an injection is successful. \n - Sanitization: No validation or sanitization of the user-provided message content is performed before it is processed by the AI model.
Audit Metadata