building-pydantic-ai-agents
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill describes how agents ingest data from external sources via tool results, multimodal inputs, and mid-run message injection (
RunContext.enqueue). It includes mandatory safety guidance warning developers that enqueuedSystemPromptPartobjects carry operator authority and should not be built from untrusted data (e.g., tool outputs or webhooks) to avoid load-bearing prompt injection attacks. - Ingestion points: untrusted data enters the agent context through
Agent.runinputs, tool result payloads, and content enqueued during execution. - Capability inventory: Includes capabilities for
WebSearch,WebFetch,CodeExecutionTool, and arbitrary function tools. - Boundary markers: Notes that enqueued system instructions are rendered with
<system>tags on supported providers, distinguishing them from standard user content. - Sanitization: Recommends using the
ProcessHistorycapability to implement custom history trimming, PII removal, and summarization policies before data is sent to providers. - [COMMAND_EXECUTION]: Provides instructions for configuring the
CodeExecutionTool, which utilizes provider-native sandboxed environments (such as OpenAI's code interpreter) for executing model-generated code. - [EXTERNAL_DOWNLOADS]: Documents integration patterns for well-known services and search providers including DuckDuckGo, Tavily, Exa, and Model Context Protocol (MCP) servers.
- [SAFE]: Includes security best practices for observability, specifically cautioning against the use of full HTTP capture (
capture_all=True) in production logging to prevent the accidental exposure of secrets, credentials, or sensitive prompt content in diagnostic telemetry.
Audit Metadata