dify-knowledge-base-search
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted data retrieved from an external source (Dify Knowledge Base).
- Ingestion points: External data enters the agent's context through the
recordsfield in the API response, as documented inreferences/request-response.md. - Capability inventory: The skill performs network operations via
curland instructs the agent to interpret and act upon the retrieved record content. - Boundary markers: No delimiters or specific instructions to ignore embedded commands within the retrieved text are present in
SKILL.md. - Sanitization: There is no evidence of content filtering, escaping, or schema validation for the retrieved records before they are processed by the agent.
Audit Metadata