An AI-powered career guidance and personal development system that orchestrates multiple specialized agents (Sarpanch, Shiksha, Kaam, Swasthya, Risk Mantri) to provide comprehensive career planning, learning roadmaps, productivity scheduling, health guidance, and risk analysis through a LangGraph-based workflow.
PanchayatAI exposes 5 tools with minimal schema definition and poor naming conventions. Tool names lack action verbs (sarpanch_agent, learning_agent, etc. are nouns, not verbs like 'get_', 'create_', 'generate_'). Input schemas are present but extremely sparse: most tools accept only 1-2 string parameters with minimal type information. Descriptions exist but are verbose (200+ chars) and lack actionable guidance on WHEN to use each tool or what it returns. No output schemas are documented. No error handling guidance. Tools appear to be agent orchestration wrappers rather than discrete, composable operations. The codebase shows LLM invocations with prompt injection risks (user input directly interpolated into prompts) and no input validation.
Swasthya Mantri (Health Advisor) that provides health guidance including sleep recommendations, burnout prevention, exercise suggestions, screen-time advice, and work-life balance recommendations.
Shiksha Mantri (Learning Advisor) that generates learning roadmaps, study plans, course recommendations, and project progression based on career plans and knowledge base context.
Kaam Mantri (Productivity Advisor) that generates study schedules, focus strategies, break recommendations, and consistency tips based on career and learning plans.
Risk Mantri that identifies weaknesses, missing skills, unrealistic expectations, burnout risks, and execution problems based on user context and knowledge base.
Chief Career Advisor that provides career guidance, AI engineering roadmap, role progression, skill planning, and project recommendations based on user goals and knowledge base context.
Tool names are nouns, not action verbs. 'sarpanch_agent', 'learning_agent' do not follow verb_noun convention (get_, create_, generate_). LLMs cannot infer intent from names alone.
Input schemas are minimal. Most tools accept only 1-2 string parameters with no enum constraints, format specifications, or validation rules. E.g., 'user_goal' is a bare string with no length limits or examples of valid inputs.
No output schemas documented. Tools invoke LLMs and return unstructured text or JSON extracted via regex. Agents cannot plan downstream calls or validate response structure.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 29 | 2026-07-28+ | v2 |
Prompt injection risk: user input (career_plan, shared_context, user_goal) is directly interpolated into LLM prompts without sanitization. Malicious input could break prompt structure or exfiltrate context.
No error handling or recovery guidance. JSON extraction via regex can fail silently or throw ValueError. No guidance for LLM on what to do if parsing fails or if knowledge base returns insufficient context.