streamlit
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The 'Chat UIs' section describes an application pattern that ingests untrusted user input and processes it through an LLM without explicit sanitization or boundary markers.
- Ingestion points: User input collected via
st.chat_inputin the Chat UIs code example (SKILL.md). - Boundary markers: The example does not include delimiters or specific instructions to the agent to ignore potentially malicious content within the user prompt.
- Capability inventory: The pattern involves an LLM integration (
stream_llm) and writing to the session state, allowing injected instructions to persist across reruns. - Sanitization: There is no evidence of sanitization or filtering of the input before it is rendered with
st.markdownor sent to the LLM.
Audit Metadata