langgraph-workflows
Warn
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The
calculatortool in Pattern 3 uses Python'seval()function to execute logic based on strings generated from agent messages. This pattern allows for the execution of arbitrary Python code on the host machine if the model is influenced by untrusted input to generate malicious expressions.- [INDIRECT_PROMPT_INJECTION]: The skill architecture allows untrusted user data to reach a code execution sink via the agent state machine without sufficient isolation. - Ingestion points: User-provided messages stored in the
messageslist within theAgentStateTypedDict inSKILL.md. - Boundary markers: Absent. The graph patterns do not implement delimiters or specific system instructions to prevent the model from obeying instructions embedded within user content.
- Capability inventory: Arbitrary code execution capability via the
eval()call in thecalculatortool defined inSKILL.md. - Sanitization: The skill lacks any input validation, filtering, or escaping for the
expressionparameter before it is passed to the execution sink.
Audit Metadata