neo4j-genai-plugin-skill
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes content retrieved from graph nodes (e.g., node properties like 'c.text' and 'p.description') and concatenates it directly into LLM prompt strings for functions such as 'ai.text.completion' and 'ai.text.chat'. This creates a surface for indirect prompt injection if the data in the graph originates from untrusted users or external sources.
- Ingestion points: Graph node properties are ingested via Cypher MATCH queries in 'SKILL.md' and passed to LLM functions.
- Boundary markers: No delimiters or 'ignore' instructions are present; the skill uses simple string concatenation (e.g., 'Summarize: ' + $text) which allows data to potentially blend with instructions.
- Capability inventory: The skill uses the Neo4j GenAI plugin to perform network requests to external LLM providers (OpenAI, Azure, VertexAI, Bedrock).
- Sanitization: The provided examples do not include any escaping or validation logic for the text before it is used in prompts.
Audit Metadata