openai-chatkit-backend-python
Fail
Audited by Gen Agent Trust Hub on Feb 16, 2026
Risk Level: HIGHPROMPT_INJECTION
Full Analysis
- [Indirect Prompt Injection] (HIGH): The skill's primary function is to create a gateway for untrusted external data (user messages from ChatKit) to be processed by an AI agent.
- Ingestion points: The
/chatkit/apiendpoint intemplates/fastapi_main.pyand thehandle_eventfunction intemplates/router.pyconsume raw JSON from the request body. - Boundary markers: The current templates use basic string interpolation (
input=text) without advanced delimiters or explicit "ignore embedded instructions" hardening at the prompt level. - Capability inventory: The examples (
examples.md) and architectural guide (reference.md) demonstrate capabilities including file system writes (handle_upload), database lookups (get_employee), and multi-agent orchestration. These capabilities, when combined with untrusted input, create a significant attack surface. - Sanitization: The
chatkit-backend/changelog.mdfile correctly identifies these risks and provides specific security best practices (validating thread ownership, sanitizing file types, and using authentication context) which mitigates some implementation risks but doesn't eliminate the fundamental injection surface.
Recommendations
- AI detected serious security threats
Audit Metadata