snowflake-cortex-ai
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from various sources (database tables, documents, audio files) and pass them directly into Large Language Models (LLMs) via Snowflake Cortex AI functions.
- Ingestion points: Untrusted data enters the agent context through Snowflake tables (
reviews,tickets,customer_feedback), stages (@docs/invoice.pdf,@media/recording.mp3), and search results fromCORTEX SEARCH SERVICE. - Boundary markers: The skill lacks explicit instructions for the agent to include boundary markers (like XML tags or clear delimiters) when interpolating untrusted data into prompts, which is a known vulnerability surface.
- Capability inventory: The skill facilitates LLM execution (
AI_COMPLETE,AI_CLASSIFY), structured data extraction (AI_EXTRACT), and database filtering (AI_FILTER), which could be influenced by malicious instructions embedded in the source text. - Sanitization: There are no instructions provided for sanitizing or escaping the content retrieved from tables or documents before it is concatenated into prompts (e.g.,
'Summarize: ' || review_text).
Audit Metadata