weaviate-cookbooks
Pass
Audited by Gen Agent Trust Hub on Jul 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The implementation guides provide instructions for installing development tools such as
uv(from astral.sh) andollama(from ollama.com). Both are well-known services for AI application development. - [DATA_EXPOSURE]: The skill includes a dedicated reference for environment requirements and strictly recommends the use of
.gitignoreand security configurations (e.g.,.claude/settings.json) to prevent the accidental exposure of sensitive API keys and credentials. - [PROMPT_INJECTION]: The cookbooks describe Retrieval-Augmented Generation (RAG) architectures which ingest untrusted data from external sources such as user queries and PDF documents. This creates a surface for potential indirect prompt injection attacks.
- Ingestion points:
references/pdf_multimodal_rag.md(PDF processing),references/basic_rag.md(user input handling). - Boundary markers: The guides suggest using structured output frameworks like DSPy, which help separate instructions from data, though they do not provide specific delimiter implementations.
- Capability inventory: Retrieval operations via
weaviate-clientand generation viaollamaor other LLM providers. - Sanitization: The skill explicitly instructs developers to review generated applications for security, data privacy, and prompt injection exposure before production deployment.
Audit Metadata