unopim-ai-agent
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The agent ingests untrusted data from product catalogs and chat history, which the documentation acknowledges as a potential steering risk.
- Ingestion points: Data enters via
ChatContext(history, SKU, name) and database reads through tools. - Boundary markers: Relies on system prompt instructions (e.g., asking for confirmation) to mitigate unintended actions.
- Capability inventory: Subprocess/console commands, database writes (repositories), and user management.
- Sanitization: Enforces strict regex allow-listing for identifiers (e.g.,
/^[a-zA-Z0-9_-]+$/) and PII masking for outputs. - [PROMPT_INJECTION]: The system's 'suggest' mode for write tools is enforced only by model instructions ('enforced by nothing but the model'), allowing for potential safety bypasses if the model's constraints are overridden.
- [COMMAND_EXECUTION]: Potential for unintended tool exposure due to typos in ACL keys, which can cause permissions to fall through to users with 'all' permission types.
Audit Metadata