rag-systems
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements Retrieval-Augmented Generation (RAG) patterns that ingest untrusted external data and interpolate it directly into LLM prompts without robust sanitization or delimiters. This creates a vulnerability surface where malicious instructions embedded in source documents (like PDFs or text files) could be executed by the agent at runtime.
- Ingestion points: Document loading logic in
SKILL.md(PyPDFLoader), processing pipelines inscripts/rag_pipeline.py(ingest method), and manual document indexing examples. - Boundary markers: The prompt templates in
SKILL.md(AdvancedRAG class) andscripts/rag_pipeline.py(RAGPipeline.generate) use simple text headers like "Context:" and "Question:" but lack cryptographically secure delimiters or explicit instructions for the agent to ignore commands within the context. - Capability inventory: The skill performs file system reads (document loading) and network operations (API calls to OpenAI and Hugging Face providers).
- Sanitization: No validation or filtering logic is present to identify or neutralize prompt injection attempts within the retrieved document chunks before they are sent to the model.
Audit Metadata