dspy-rag-pipeline
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill architecture is susceptible to indirect prompt injection through the retrieval component which fetches external text to be used as context for the language model.\n
- Ingestion points: External data is ingested via the ColBERTv2 retriever in
SKILL.md(usingself.retrieve(question).passages) and used to populate the prompt context.\n - Boundary markers: The DSPy signatures (e.g.,
GenerateAnswer) define input fields but do not implement strong structural delimiters or "ignore embedded instructions" warnings to prevent the model from obeying instructions contained within retrieved passages.\n - Capability inventory: The skill invokes language models via
dspy.ChainOfThought, which can follow complex instructions found in the untrusted context.\n - Sanitization: The implementation does not include any validation or sanitization logic for the retrieved text before it is interpolated into the model's context.\n- [DATA_EXFILTRATION]: The skill transmits user queries to a remote retrieval server, which involves network activity to a non-whitelisted endpoint.\n
- Evidence: The skill is configured to connect to
http://20.102.90.50:2017/wiki17_abstractsinSKILL.md. While this is a known public endpoint for DSPy, it represents an external dependency that receives user input.
Audit Metadata