Shared Pinecone RAG

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:16 AM UTC
• Version: 1.0.1

Overview

This skill is purpose-aligned for shared RAG use, but it gives all agents shared ingestion/query access and runs mutable external local code without enough scoping or data-safety guidance.

Review before installing. Only use this with non-sensitive documents approved for a shared Pinecone index, confirm who can query the default namespace, and verify the external rag-pinecone-starter project and .venv are trusted and protected from modification.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/ingest-shared-rag.sh:4
• Finding: Execution of Mutable External Code Without Integrity Verification## Vulnerability Details **File Location**: `scripts/ingest-shared-rag.sh:4-8`, `scripts/query-shared-rag.sh:9-14`, and `SKILL.md:8-9, 22-31` **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium **Vulnerable code in `scripts/ingest-shared-rag.sh`:** ```bash RAG_DIR="/home/Mike/.openclaw/workspace/rag-pinecone-starter" cd "$RAG_DIR" source .venv/bin/activate python ingest.py ``` **Vulnerable code in `scripts/query-shared-rag.sh`:** ```bash RAG_DIR="/home/Mike/.openclaw/workspace/rag-pinecone-starter" QUESTION="$*" cd "$RAG_DIR" source .venv/bin/activate python query.py "$QUESTION" ``` **Related instructions in `SKILL.md`:** ```markdown Use the central RAG project at: `/home/Mike/.openclaw/workspace/rag-pinecone-starter` ``` ```markdown ## Requirements - `PINECONE_API_KEY` must be set in `rag-pinecone-starter/.env` - Python venv exists at `rag-pinecone-starter/.venv` ``` ### Technical Analysis Both shell wrappers transfer execution to a fixed external workspace that is not included in the audited project and is not protected by any version pinning, checksum, signature, ownership validation, or permission check. The command `source .venv/bin/activate` executes the contents of an external shell file inside the current shell process. A virtual-environment activation script can contain arbitrary shell commands, so modification of that file is sufficient to execute attacker-controlled code. The wrappers then invoke the external and mutable `ingest.py` or `query.py` file through a relative path. Consequently, the effective behavior of this Skill can change without any modification to the reviewed artifact. The absent external files cannot be classified as malicious based on the available evidence, but trusting and executing them without integrity controls creates an unsafe local supply-chain boundary. The query argument itself is passed as the safely quoted `"$QUESTION ...[truncated 1940 chars]
• Remediation: ## Remediation Suggestions 1. Package the required Python entry points with the Skill so that all executable behavior can be reviewed and versioned together. 2. If the external project must remain separate, pin it to an approved version and verify a cryptographic hash or signature before every execution. 3. Do not source the virtual-environment activation script. Invoke the intended interpreter directly: ```bash "$RAG_DIR/.venv/bin/python" "$RAG_DIR/ingest.py" ``` ```bash "$RAG_DIR/.venv/bin/python" "$RAG_DIR/query.py" "$QUESTION" ``` 4. Use absolute paths for every executed file and validate that the project directory, interpreter, and Python entry points are owned by a trusted account and are not writable by untrusted users or groups. 5. Fail closed when ownership, permissions, expected versions, or integrity checks do not match the approved configuration. 6. Run the RAG code under a dedicated least-privilege account or sandbox with access only to required documents, network endpoints, and credentials. 7. Store the Pinecone credential with restrictive permissions and limit its service-side privileges to the necessary index and operations. 8. Document that ingestion and query data may be processed by an external service, including applicable data-handling, authorization, and confidentiality requirements.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The skill advertises itself for 'any agent' needing ingestion or semantic context, which encourages broad invocation without clear scope, authorization boundaries, or data-sensitivity checks. In a shared RAG setup, this can cause agents to route arbitrary workspace content into a common retrieval system, increasing the risk of inappropriate access, accidental data mixing, and privacy violations.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The documentation instructs users to place files into a shared ingestion directory and ingest them into a shared Pinecone index, but it provides no warning about confidentiality, multi-tenant data exposure, or retention implications. Because retrieval reads from a shared default namespace, one agent's uploaded documents may become discoverable by other agents, making accidental cross-agent data leakage a realistic outcome.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script unconditionally activates a local virtual environment and runs `python ingest.py` against a shared Pinecone RAG workspace, which can ingest or modify shared indexed data without any confirmation, scope check, or user disclosure. In a shared workspace context, this increases the risk of accidental bulk ingestion of sensitive documents, unintended data propagation to other agents, or use of a tampered `ingest.py` from that shared directory.

Static analysis

No suspicious patterns detected.