rag-architect

Pass

Audited by Gen Agent Trust Hub on Jun 25, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill includes Python code examples that download legitimate resources from well-known services. Specifically, it uses nltk.download('punkt') to fetch standard tokenizer models and utilizes the AutoModel.from_pretrained method to load models from Hugging Face repositories.
  • [DYNAMIC_EXECUTION]: The references/chunking-strategies.md file contains a code snippet for 'Late Chunking' that uses trust_remote_code=True when loading a model from the Jina AI organization on Hugging Face. This is a standard and expected machine learning practice for specialized model architectures that require custom code for tokenization or pooling operations.
  • [PROMPT_INJECTION]: Several implementation templates for RAG components, such as contextual chunking and query expansion, involve processing user queries and external document content through LLM APIs. This establishes a potential surface for indirect prompt injection if the ingested data contains adversarial instructions. This risk is inherent to the RAG architecture described by the skill and is documented as a design consideration rather than a malicious intent.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 25, 2026, 12:42 PM
Security Audit — agent-trust-hub — rag-architect