rag-infrastructure
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and retrieve external document content for use in LLM prompts, which is a known vector for indirect prompt injection attacks.
- Ingestion points: Document text is processed in the
ingest_documentsfunction and stored in a vector database. - Boundary markers: The
rag_queryfunction uses a system prompt with the instruction 'Answer the question using only the provided context', which serves as a basic but bypassable boundary. - Capability inventory: The skill uses standard vector database and LLM API clients for retrieval and generation tasks.
- Sanitization: No explicit sanitization or validation of the retrieved document chunks is performed before they are concatenated into the LLM context variable.
Audit Metadata