regex-vs-llm-structured-text
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The implementation of the
validate_with_llmfunction (SKILL.md) creates a vulnerability where malicious instructions embedded in the input text could override the agent's parsing logic. - Ingestion points: The
original_textparameter invalidate_with_llmaccepts raw data from theprocess_documentpipeline. - Boundary markers: The prompt template uses simple newline spacing to separate the untrusted text from instructions. It lacks explicit delimiters (e.g., XML tags) or system-level instructions to ignore command-like content within the source text.
- Capability inventory: The skill utilizes an LLM client to perform data extraction and validation (
client.messages.create), creating a path for untrusted data to influence the final structured output. - Sanitization: There is no evidence of input sanitization, filtering, or escaping before the source text is interpolated into the message string.
Audit Metadata