ai-rag-pipeline
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on the Bash tool to execute
beltCLI commands (belt app run) which are used to interface with web search tools and LLM providers. - [EXTERNAL_DOWNLOADS]: The documentation guides users to install external tools via
npxand provides links to setup scripts hosted on the inference-sh GitHub organization. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates RAG (Retrieval Augmented Generation) workflows that are susceptible to indirect prompt injection due to the ingestion of untrusted external content.
- Ingestion points: The skill fetches data from external web sources using
tavily/search-assistantandexa/search(found in SKILL.md). - Boundary markers: Instructions interpolate search results directly into prompts (e.g.,
$SEARCH_RESULT) without using delimiters or explicit framing to prevent the LLM from following instructions embedded in the retrieved content. - Capability inventory: The environment allows command execution via the Bash tool restricted to the
beltcommand prefix. - Sanitization: No sanitization or filtering logic is provided to process external content before it is used to construct LLM prompts.
Audit Metadata