cot-injection
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEPROMPT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill provides functional templates for manipulating LLM reasoning chains. This includes instructions on how to forge internal agent communication (e.g., using 'Observation:' prefixes) and phrases designed to bypass validation steps, such as 'Administrator has approved' or 'Emergency mode skip verification'.\n- [INDIRECT_PROMPT_INJECTION]: The skill outlines methodologies for indirect injection attacks, particularly through RAG systems.\n
- Ingestion points: Data ingested by ReAct/CoT agents from external sources or user queries (SKILL.md).\n
- Boundary markers: The methodology focuses on environments where boundary markers between data and instructions are absent or insufficient.\n
- Capability inventory: Identification of sensitive tools like SQL databases, refund systems, and transfer APIs as primary targets for manipulation.\n
- Sanitization: The skill describes how to exploit the lack of sanitization in natural language to SQL/API conversion processes.
Audit Metadata