ClawHub
Back to skill

Security audit

RAG Engineering

Security checks for vulnerabilities and agentic risk

Overview

This is a methodology-only RAG engineering skill with broad but RAG-related trigger examples and no executable code or hidden behavior.

Before installing, understand that this skill is a RAG engineering playbook. It may recommend cloud AI providers, vector databases, logging, document ingestion, and evaluation tools; review those choices separately for privacy, cost, and compliance before using them with sensitive data.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger phrase design overlaps with ordinary help-seeking language, which can cause the skill to activate unintentionally in contexts where the user did not explicitly request this methodology. In an agent environment, overly broad activation can override user intent, inject irrelevant workflow steps, or steer the conversation into unintended tool usage and retrieval behavior.

Vague Triggers

Low
Confidence
82% confidence
Finding
The invocation examples are illustrative but do not establish strict activation boundaries, making it ambiguous when the skill should take control. Ambiguous routing increases the chance of prompt/skill overreach, where a general user request is interpreted as a command to apply this entire operational playbook, reducing predictability and potentially affecting downstream tool or data access patterns.

Intent-Code Divergence

Low
Confidence
95% confidence
Finding
Line L993 states the skill has 'Zero dependencies. Pure methodology.' However, the document repeatedly recommends concrete dependencies and third-party services such as PyMuPDF, BeautifulSoup, pandas, OpenAI embeddings, Pinecone, Weaviate, Cohere, and others throughout the file. This is an active contradiction in the documentation rather than a mere omission.

Static analysis

No suspicious patterns detected.