api-vector-db-weaviate
Pass
Audited by Gen Agent Trust Hub on Nov 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements Retrieval Augmented Generation (RAG) patterns that interpolate untrusted data from the vector database into prompts for generative models.
- Ingestion points: Data retrieved from Weaviate collections (e.g., Article, Product, Document) via generate.nearText and generate.hybrid methods in examples/search.md and SKILL.md.
- Boundary markers: Example prompts such as 'Summarize this article in one tweet: {title}
- {body}' do not utilize delimiters or instructions to the model to ignore potential instructions embedded within the interpolated data.
- Capability inventory: The skill uses the weaviate-client to perform network operations to Weaviate instances and allows for collection management and data insertion across multiple scripts.
- Sanitization: There is no evidence of sanitization or escaping of the property values before they are interpolated into the generative search prompts.
Audit Metadata