chroma
Warn
Audited by Gen Agent Trust Hub on Feb 16, 2026
Risk Level: MEDIUMPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- PROMPT_INJECTION (MEDIUM): The skill is designed to ingest and query external documents for RAG applications, creating a significant Indirect Prompt Injection surface.
- Ingestion points: Untrusted data enters via
collection.add(documents=...)andcollection.query(query_texts=...)in SKILL.md. - Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present in the documentation.
- Capability inventory: The skill utilizes
HttpClientfor network communication andPersistentClientfor file system persistence. - Sanitization: No sanitization, escaping, or validation of document content is demonstrated.
- EXTERNAL_DOWNLOADS (MEDIUM): The skill specifies dependencies without version pinning, which can lead to the installation of unverifiable or malicious package versions.
- Evidence: YAML frontmatter lists
chromadbandsentence-transformerswithout version constraints. - COMMAND_EXECUTION (LOW): The skill provides instructions for the agent or user to execute commands locally.
- Evidence: Documentation includes shell commands for installation (
pip install,npm install) and server operations (chroma run).
Audit Metadata