ai-core/ag-ui-protocol
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines how to process untrusted data from client-side requests (
messages,forwardedProps) which are passed to the AI runtime. - Ingestion points: The
POSTrequest body inSKILL.mdexamples serves as the entry point for external data. - Boundary markers: The skill relies on internal model adapter logic to delimit messages (not explicitly configured in the provided snippets).
- Capability inventory: The implementation enables network operations to stream AI-generated content back to the client via SSE or NDJSON.
- Sanitization: The skill contains a specific security warning against directly spreading
forwardedProps, advising developers to use allowlists to prevent unauthorized overrides of model or tool configurations. - [COMMAND_EXECUTION]: The code examples utilize the
chat()function from@tanstack/ai. While this facilitates interaction with AI models, the skill does not include or invoke any arbitrary shell command execution patterns.
Audit Metadata