ai-vector-brain
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill facilitates the creation of a retrieval-augmented generation (RAG) system, creating an attack surface for indirect prompt injection via ingested document content.
- Ingestion points: Data is read from local files and processed for indexing in scripts/inventory_corpus.py, scripts/prepare_documents.py, and scripts/chunk_corpus_files.py.
- Boundary markers: The skill includes instructions in SKILL.md and references/agent-tool-contract.md for agents to treat retrieved data as untrusted evidence rather than instructions.
- Capability inventory: The system performs database operations via psycopg and makes external API calls to embedding providers. Testing scripts use subprocess.run for local execution.
- Sanitization: Retrieval results are handled as structured JSON data to maintain separation from instructions.
- [COMMAND_EXECUTION]: Build and testing utilities in the toolkit utilize local command execution to automate workflows.
- Evidence: scripts/test_build_vector_hub.py and scripts/test_check_brain_manifest.py use subprocess.run to execute local sibling scripts within the project environment.
- Evidence: scripts/build_vector_hub.sh uses shell commands (find, wc) to count files and prepare inventory during the build process.
- [EXTERNAL_DOWNLOADS]: The skill connects to well-known technology services to generate embeddings and perform reranking.
- Evidence: scripts/embed_and_load.py and scripts/retrieve.py transmit content to official API endpoints for OpenAI, Voyage AI, Cohere, Google (Gemini), and Amazon (Bedrock). These are well-known services and do not involve untrusted remote code execution.
Audit Metadata