azure-ai-openai-dotnet
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides instructions for building applications that process external data, creating an attack surface for indirect prompt injection.
- Ingestion points: Untrusted data enters the context via Azure AI Search results (
AzureSearchChatDataSource) and function/tool arguments (ChatToolCall) as documented in SKILL.md. - Boundary markers: The provided C# code examples do not include explicit prompt delimiters (e.g., XML tags or triple quotes) or specific instructions for the model to ignore embedded commands within the retrieved search content.
- Capability inventory: The code snippets demonstrate capabilities for network communication with Azure services and local file system writes (e.g., saving audio to
output.mp3). - Sanitization: The skill includes a clear remediation warning in the 'Limitations' section, advising developers to treat retrieved text and tool arguments as untrusted and to authorize side effects independently.
Audit Metadata