vector-db-ingest
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the Bash tool to execute local Python scripts including
scripts/init.py,scripts/ingest.py, andscripts/query.pyto manage the vector database lifecycle. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content by ingesting repository files into a ChromaDB vector store. This creates a vulnerability surface where malicious instructions embedded in the source files could be retrieved during semantic search and influence the agent's future actions.
- Ingestion points: Reads repository files and directories via
scripts/ingest.py(referenced inSKILL.md). - Boundary markers: None identified in the provided instructions to differentiate between data and instructions during ingestion.
- Capability inventory: The skill has
Bash,Read, andWritepermissions, allowing it to execute commands and modify files based on potentially poisoned search results. - Sanitization: No evidence of sanitization or filtering for the content being indexed is provided in the skill instructions.
Audit Metadata