rag-architect
Pass
Audited by Gen Agent Trust Hub on Jun 25, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill includes Python code examples that download legitimate resources from well-known services. Specifically, it uses
nltk.download('punkt')to fetch standard tokenizer models and utilizes theAutoModel.from_pretrainedmethod to load models from Hugging Face repositories. - [DYNAMIC_EXECUTION]: The
references/chunking-strategies.mdfile contains a code snippet for 'Late Chunking' that usestrust_remote_code=Truewhen loading a model from the Jina AI organization on Hugging Face. This is a standard and expected machine learning practice for specialized model architectures that require custom code for tokenization or pooling operations. - [PROMPT_INJECTION]: Several implementation templates for RAG components, such as contextual chunking and query expansion, involve processing user queries and external document content through LLM APIs. This establishes a potential surface for indirect prompt injection if the ingested data contains adversarial instructions. This risk is inherent to the RAG architecture described by the skill and is documented as a design consideration rather than a malicious intent.
Audit Metadata