neo4j-aura-agent-skill
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources, providing a surface for indirect prompt injection.
- Ingestion points:
scripts/invoke_agent.pytakes natural language input from users, andscripts/fetch_schema.pyretrieves graph schema information (labels, relationship types, and property metadata) directly from a Neo4j database. - Boundary markers: The skill's scripts do not utilize delimiters or explicit instructions to ignore potentially malicious content embedded in the ingested schema data or user queries.
- Capability inventory: The skill possesses significant capabilities, including the ability to manage Aura Agents (create, update, delete) and execute Cypher queries on the connected database instance.
- Sanitization: The scripts rely on standard formatting for most operations, but
scripts/fetch_schema.pyuses f-string interpolation for Cypher queries involving node labels (e.g., in_check_cardinality), which could be exploited if label names contain injection payloads such as backticks. - [DYNAMIC_EXECUTION]: The
scripts/fetch_schema.pyscript performs runtime assembly of Cypher strings based on metadata fetched from the database, representing a form of dynamic execution triggered by external data sources.
Audit Metadata