ai-rag-pipeline
Pass
Audited by Gen Agent Trust Hub on Mar 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill requests broad execution permissions via
allowed-tools: Bash(infsh *). While this is consistent with the vendor's intended use of theinfshCLI to manage apps and models, it grants the agent permission to run any subcommand under theinfshtool. - [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection where malicious instructions embedded in web pages or search results could influence the agent's behavior.
- Ingestion points: Untrusted data enters the context via the
tavily/search-assistant,exa/search, andtavily/extracttools which fetch live content from the internet. - Boundary markers: The templates use weak or absent boundary markers (e.g., simple headers like 'Search Results: $SEARCH_RESULT') which do not reliably prevent an LLM from following instructions contained within the variable content.
- Capability inventory: The skill uses
infsh app runacross various scripts to interact with external LLM providers and search APIs. - Sanitization: There is no evidence of escaping, filtering, or validation performed on the retrieved content before it is interpolated into model prompts.
Audit Metadata