hybrid-search-implementation
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: The skill provides developer templates for hybrid search implementation including Reciprocal Rank Fusion (RRF) and linear combination patterns.
- [SAFE]: Code samples for PostgreSQL (pgvector) use parameterized queries to prevent SQL injection.
- [INDIRECT_PROMPT_INJECTION]: The RAG pipeline architecture implemented by these templates is a surface for indirect prompt injection.
- Ingestion points: External document content indexed in PostgreSQL and Elasticsearch (detailed in resources/implementation-playbook.md).
- Boundary markers: The playbook advises developers to derive tenant/ACL constraints from authenticated context and treat documents as data.
- Capability inventory: Database operations (read/write), network requests for embeddings and reranking.
- Sanitization: Employs parameterized queries for PostgreSQL and structured match queries for Elasticsearch.
- [EXTERNAL_DOWNLOADS]: The templates reference well-known Python packages (sentence-transformers, elasticsearch, asyncpg) and models from Hugging Face, which are recognized as safe sources.
Audit Metadata