neo4j-document-import-skill

Pass

Audited by Gen Agent Trust Hub on Oct 7, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted unstructured documents (PDF, Markdown, HTML, JSON) to extract entities and relationships via an LLM. This creates an attack surface where malicious content within a document could attempt to influence the LLM's extraction logic or subsequent agent actions.
  • Ingestion points: Data enters the agent's context through SimpleKGPipeline.run_async (accepting file_path or text), apoc.load.json for external URLs, and custom DataLoader implementations using httpx in SKILL.md and references/kg-construction.md.
  • Boundary markers: The provided code snippets do not demonstrate the use of specific delimiters or explicit instructions for the LLM to ignore embedded commands within the ingested text content.
  • Capability inventory: The skill allows for writing data to a Neo4j database, performing network requests (via APOC or custom loaders), and executing Cypher queries.
  • Sanitization: The skill relies on the neo4j-graphrag library's internal logic for prompt construction and extraction; no explicit sanitization or validation of the input text is shown in the provided code examples.
  • [EXTERNAL_DOWNLOADS]: The skill instructions include installing external libraries and referencing remote code repositories.
  • Packages: It requires the installation of the official neo4j-graphrag library (supporting providers for OpenAI, Anthropic, Google, and others) and the neo4j driver, which are vendor-owned or well-known service packages.
  • Repositories: It references the official neo4j-labs/llm-graph-builder and neo4j-contrib/neo4j-skills GitHub repositories for installation and local deployment.
  • Services: It utilizes well-known LLM and cloud services including OpenAI, Anthropic, Google Vertex AI, and Amazon Bedrock.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 7, 2026, 01:46 PM