ai-rag-pipeline
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements RAG patterns that ingest content from external web searches and extraction tools (Tavily, Exa) and provide it as context to LLMs. This creates an attack surface where malicious content on a retrieved website could attempt to hijack the agent's logic or prompt. Ingestion points include results stored in variables like SEARCH_RESULT, TAVILY, EXA, and CONTENT in SKILL.md examples. Boundary markers are largely absent; the prompt templates use simple text headers (e.g., 'Search Results:', 'Source 1:') but lack robust escaping, structural delimiters (like XML/JSON), or explicit instructions to the model to ignore embedded commands within the context. Capability inventory includes the use of 'belt app run' to interact with search APIs and LLM inference services. There is no evidence of sanitization, filtering, or validation of the retrieved web content before it is interpolated into the prompt strings.
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install the 'belt' CLI tool and related skills from external repositories (e.g., github.com/inference-sh/skills).
- [COMMAND_EXECUTION]: The skill includes multiple Bash examples and templates that use the 'belt' CLI to orchestrate data flow between search tools and LLMs.
Audit Metadata