ai-rag-poisoning
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documents a vulnerability surface where untrusted data ingested from external sources can influence model behavior.
- Ingestion points: Knowledge bases, vector stores, web crawls, support tickets, emails, and pull requests are identified as primary entry points for untrusted data into the agent's context (SKILL.md).
- Boundary markers: The documentation explicitly highlights the lack of separation between data and instructions in retrieved context chunks as the primary exploit mechanism.
- Capability inventory: The technique identifies potential for data exfiltration via markdown images/links and abuse of model-accessible tools (e.g., export functions) when malicious instructions are retrieved.
- Sanitization: No sanitization or filtering logic is provided; the skill focuses on the persistence and multi-user reach of unsanitized retrieved content.
- [NO_CODE]: This skill consists entirely of instructional markdown and metadata. It does not contain any scripts, executables, or automated logic that would perform the actions described.
Audit Metadata