prompt-chaining
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The
analyze_documentfunction inSKILL.mdis vulnerable to indirect prompt injection through its document processing pipeline. - Ingestion points: The function accepts an unvalidated
textstring which is directly interpolated into the first LLM prompt. - Boundary markers: There are no delimiters (e.g., XML tags, clear separators) or system instructions provided to the LLM to distinguish between the prompt instructions and the untrusted content in the
{text}variable. - Capability inventory: The skill uses the
anthropicSDK to perform sequential message creation. A successful injection in the first step could influence the structured output (extracted['title'],extracted['key_points']), which is then fed into Step 2 and Step 3, leading to a chained injection attack. - Sanitization: The code lacks any sanitization, filtering, or validation of the input text before it is used in prompt construction.
Audit Metadata