Ragflow API Client

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:20 PM UTC
• Version: 1.0.2

Overview

This Ragflow helper does what it says, but it can delete knowledge bases and may send API keys and uploaded documents over unencrypted HTTP if configured that way.

Install only if you trust the Ragflow server and need write/delete capability. Use HTTPS for RAGFLOW_URL, prefer a least-privilege API key, avoid uploading sensitive local files unless intended, and manually confirm dataset IDs before running delete-dataset because the CLI does not ask for confirmation.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: lib/api.js:27

Finding

Bearer Credentials and Sensitive Data Can Be Transmitted over Plaintext HTTP

Content

View full analysis

{ ``` ### Technical Analysis The client automatically uses Node.js's plaintext `http` module whenever `RAGFLOW_URL` does not use HTTPS. No validation rejects an `http://` endpoint or warns the user before sending sensitive information. Every request includes `RAGFLOW_API_KEY` as a bearer credential. Depending on the operation, the same connection can also carry uploaded document contents, retrieval questions, dataset identifiers, and dataset-management commands. HTTP provides neither transport confidentiality nor server authentication, and it does not protect responses from modification. Although the configured RAGFlow server is an intended data recipient, allowing plaintext transport unnecessarily exposes both the credential and RAG data to systems positioned along the network path. ### Attack Path 1. A user or deployment configures `RAGFLOW_URL ...[truncated 1413 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/ragflow.js:202

Finding

Unsanitized Server-Controlled Content Can Inject Terminal Escape Sequences

Content

View full analysis

0) { console.log(`\n${c.dim}--- Sources (${chunks.length}) ---${c.reset}`); for (const chunk of chunks.slice(0, 5)) { console.log(`\n${c.yellow}[${chunk.document_name || 'unknown'}]${c.reset}`); const content = chunk.content || chunk.text || ''; console.log(content.substring(0, 300) + (content.length > 300 ? '...' : '')); } } } ``` ### Technical Analysis Dataset names, document names, answer text, and retrieved chunks originate from the RAGFlow server or from documents stored in the knowledge base. These values are not necessarily trustworthy. The CLI inserts them directly into output written to an ANSI-capable terminal. Length truncation does not neutralize terminal control sequences. An attacker can embed ANSI, OSC, C0, or C1 control characters near the start of a value. A compatible terminal may interpret these bytes as commands rather than visibl ...[truncated 1733 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

The documented DELETE endpoint enables destructive operations against arbitrary dataset IDs, and the skill description does not indicate any validation, ownership checks, or approval workflow around that parameter. If an agent passes attacker-influenced or mistaken identifiers to this operation, it could delete the wrong knowledge base or facilitate unauthorized destructive actions.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md

- `GET /api/v1/datasets` — List datasets
- `POST /api/v1/datasets` — Create dataset
- `DELETE /api/v1/datasets/{id}` — Delete dataset
- `POST /api/v1/datasets/{id}/documents` — Upload document
- `POST /api/v1/datasets/{id}/chunks` — Trigger parsing
- `POST /api/v1/datasets/{id}/retrieval` — RAG query

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence

Finding

The skill declares required environment secrets and operational capabilities but does not define any explicit tool scope or permission boundaries. That makes it easier for an agent or user to invoke sensitive API-backed actions without clear authorization expectations, increasing the chance of over-broad use or misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill advertises dataset deletion as a supported capability but provides no warning that the action is destructive or potentially irreversible. In an agent setting, this omission can cause accidental data loss because users may invoke deletion without understanding the consequences.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The deleteDataset function issues a DELETE request to remove a dataset, which is a destructive operation. The code includes no confirmation step, warning comment, or user-facing disclosure indicating that data may be permanently removed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The uploadDocument function reads a local file from disk and sends its contents over HTTP(S) to the configured Ragflow server using an API key. Although this is part of the function's purpose, the code provides no user-facing disclosure, confirmation prompt, or warning comment that local file contents will be transmitted to an external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The CLI performs dataset deletion immediately when given a dataset ID, with no confirmation prompt, dry-run, or force flag. In an operational RAG environment this can cause irreversible loss of knowledge bases through mistyped IDs, automation mistakes, or unsafe invocation by other tools/scripts.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.