ai-rag-pipeline
Pass
Audited by Gen Agent Trust Hub on Jul 23, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill demonstrates patterns for ingesting untrusted data from external sources (web searches via Tavily/Exa and URL extraction) and interpolating that data directly into LLM prompts. This creates a surface for indirect prompt injection. If an attacker-controlled website appears in search results, its content could potentially override the agent's instructions during the generation phase.
- Ingestion points: Data is retrieved into variables like
$SEARCH_RESULT,$TAVILY,$EXA, and$CONTENTvia CLI tool outputs. - Boundary markers: The examples use descriptive headers (e.g., 'Search Results:', 'Source 1 (Tavily):') to separate context from the main prompt, which provides minimal structure but does not include explicit safety instructions to ignore embedded commands.
- Capability inventory: The skill uses the
beltCLI (allowed viaallowed-tools) to execute various remote applications, including LLMs and search engines. - Sanitization: The provided templates do not demonstrate any sanitization, filtering, or validation of the retrieved external content before prompt interpolation.
Audit Metadata