ai-building-chatbots
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONMETADATA_POISONING
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill describes building a chatbot that processes untrusted user input and retrieved context without implementation of boundary markers or sanitization logic.
- Ingestion points: Untrusted data enters the agent context through the
user_messageandcontext/docsfields in the DSPy signatures defined inSKILL.mdandexamples.md. - Boundary markers: The provided code examples lack explicit delimiters (e.g., XML tags or block markers) or instructions to the model to ignore embedded commands within the dynamic inputs.
- Capability inventory: The generated chatbot uses LangGraph for state management and includes capabilities for database persistence via
PostgresSaverand human-in-the-loop interrupts for sensitive actions. - Sanitization: There is no evidence of input validation, escaping, or filtering of the external content before it is passed to the language model.
- [METADATA_POISONING]: The skill's description metadata includes a large block of keywords and phrases intended for search engine optimization rather than a concise summary of functionality.
- Evidence: The
descriptionfield inSKILL.mdcontains a long list of synonyms and competitor names (e.g., 'Intercom bot alternative', 'Zendesk AI alternative', 'chatbot escalation to human agent') designed to influence skill discovery.
Audit Metadata