rag-architect
Pass
Audited by Gen Agent Trust Hub on Jun 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill consists entirely of technical documentation and code examples intended for software architecture design. All external libraries and services referenced (such as LangChain, Qdrant, Pinecone, and OpenAI) are industry-standard and well-known in the AI development ecosystem.
- [SAFE]: Secret management practices are followed correctly in the code examples; no hardcoded API keys or credentials were found. Placeholders like 'YOUR_API_KEY' and 'your-api-key' are used instead.
- [SAFE]: The skill uses NLTK to download linguistic data ('punkt'), which is a standard procedure and uses trusted infrastructure.
- [PROMPT_INJECTION]: The skill provides templates for building systems that ingest external document data. This naturally introduces a surface for indirect prompt injection where untrusted retrieved content could influence an agent's reasoning. The skill proactively addresses this by including evaluation metrics for 'faithfulness' and 'groundedness' in its guidance. Evidence of data ingestion can be found in
SKILL.md(e.g.,splitter.create_documents) and the chunking examples inreferences/chunking-strategies.md.
Audit Metadata