T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/rag-service.mjs:181- Finding
Unauthenticated Arbitrary-Directory Document Ingestion
- Content
View full analysis
- Remediation
View remediation
Security audit
Zvec Local RAG Service
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent local RAG service, but it needs careful review because it exposes unauthenticated local HTTP endpoints that can index readable files and it tries to support persistent background execution.
Install only if you are comfortable running a local background service that can read and index any .txt or .md files reachable by the service account when requested. Keep it bound to 127.0.0.1, do not enable non-loopback hosting unless you add authentication and network controls, avoid pointing ingestion at broad or sensitive directories, and review or pin dependencies before bootstrap. The missing launchd template should be fixed before relying on the persistence workflow.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/rag-service.mjs:45- Finding
Unbounded Request Bodies and Ingestion Work Permit Denial of Service
- Content
View full analysis
rows.push({ id: `${path.basename(f)}#${idx + 1}`, source: path.resolve(f), chunkIndex: idx + 1, text: c, })); } if (!rows.length) return { files: files.length, chunks: 0 }; const firstVec = await embed(rows[0].text); ensureCollection(firstVec.length, reset); const docs = [{ id: rows[0].id, vectors: { embedding: firstVec }, fields: { source: rows[0].source, chunkIndex: rows[0].chunkIndex, text: rows[0].text }, }]; for (let i = 1; i < rows.length; i++) { const vec = await embed(rows[i].text); docs.push({ id: rows[i].id, vectors: { embedding: vec }, fields: { source: rows[i].source, chunkIndex: rows[i].chunkIndex, text: rows[i].text }, }); } ``` ### Technical Analysis `readJsonBody()` buffers the compl ...[truncated 2256 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
package.json:5- Finding
Runtime Installation of an Unlocked Third-Party Dependency
- Content
View full analysis
&2 exit 1 fi # Explicit dependency install (declared in skill metadata) if [ ! -d "$SKILL_DIR/node_modules/@zvec/zvec" ]; then npm install --prefix "$SKILL_DIR" fi } ``` ### Technical Analysis The package declares `@zvec/zvec` using the floating range `^0.2.0`, while the audited project contains no lockfile. The bootstrap process invokes `npm install`, causing npm to resolve the dependency and its transitive dependency graph at installation time. Consequently, the installed code can differ from what was available during the audit. npm installation may also execute package lifecycle scripts or install native components with the privileges of the user running `manage.sh`. This is a supply-chain hardening deficiency; the audit did not identify evidence that the named package is itself malicious. ### Attack Path 1. A user executes `scripts/manage.sh bootstrap`, `start`, or `install-launchd` without an existing local installation. 2. `ensure_deps()` invokes `npm install --prefix "$SKILL_DIR"`. 3. npm resolves the newest versions permitted by `^0.2.0` and any ranges in transitive dependencies. 4. If an upstream account, package release, registry response, or transitive dependency is compromised, npm downloads the altered component. 5. Package lifecycle scripts or subsequently imported package code execute with the invoking user's privileges. 6. A compromised component could access user-readable files, modify project or user files, communicate over the network, or affect the long-running RAG service. ### Impact Assessmen ...[truncated 583 chars]- Remediation
View remediation
Vulnerability Patterns
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (44)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/rag-service.mjs` → HTTP service implementation
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/manage.sh` → bootstrap/start/stop/restart/health/ingest/search
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/manage.sh` → bootstrap/start/stop/restart/health/ingest/search
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/manage.sh` → bootstrap/start/stop/restart/health/ingest/search
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/manage.sh` → bootstrap/start/stop/restart/health/ingest/search
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/manage.sh` → bootstrap/start/stop/restart/health/ingest/search
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/manage.sh` → bootstrap/start/stop/restart/health/ingest/search
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/manage.sh` → bootstrap/start/stop/restart/health/ingest/search
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/manage.sh` → bootstrap/start/stop/restart/health/ingest/search
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/manage.sh` → bootstrap/start/stop/restart/health/ingest/search
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/manage.sh` → bootstrap/start/stop/restart/health/ingest/search
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/manage.sh` → bootstrap/start/stop/restart/health/ingest/search
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/manage.sh` → bootstrap/start/stop/restart/health/ingest/search
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/manage.sh` → bootstrap/start/stop/restart/health/ingest/search
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/manage.sh` → bootstrap/start/stop/restart/health/ingest/search
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/manage.sh` → bootstrap/start/stop/restart/health/ingest/search
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/manage.sh` → bootstrap/start/stop/restart/health/ingest/search
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/manage.sh` → bootstrap/start/stop/restart/health/ingest/search
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/manage.sh` → bootstrap/start/stop/restart/health/ingest/search
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
sh } stop_manual() { if is_running; then kill "$(cat "$PID_FILE")"; rm -f "$PID_FILE"; echo "Stopped service"; else echo "Service is not running"; fi } write_plist() {
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
sh } stop_manual() { if is_running; then kill "$(cat "$PID_FILE")"; rm -f "$PID_FILE"; echo "Stopped service"; else echo "Service is not running"; fi } write_plist() {
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill clearly instructs the user to run shell commands and manage a local service, but it does not declare any tool scope such as allowed shell usage. That mismatch weakens security boundaries because an agent or reviewer cannot tell from the manifest that the skill requires command execution and persistence-related operations.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 95% confidence
- Finding
The skill explicitly includes a launchd LaunchAgent template, which is a persistence mechanism that causes code to keep running across sessions. Even though this is aligned with the skill's purpose, persistence materially increases risk because a compromised or misconfigured service would survive reboots and continue exposing local HTTP functionality.
- Content
md - `scripts/rag-service.mjs` → HTTP service implementation - `scripts/manage.sh` → bootstrap/start/stop/restart/health/ingest/search - `references/launchd.plist.template` → macOS LaunchAgent template ## Prerequisites
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 96% confidence
- Finding
The quick-start instructions direct the user to install a launchd agent, which establishes persistent execution on macOS. Persistence is security-relevant because it extends the lifetime of the service and any associated exposure, making accidental or malicious misuse harder to notice and remove.
- Content
bash scripts/manage.sh bootstrap scripts/manage.sh install-launchd # writes plist, inspect once scripts/manage.sh start scripts/manage.sh health
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md # 3) verify health scripts/manage.sh health # 4) create tiny test corpus mkdir -p ./docs cat > ./docs/sample.md <<'EOF' Zvec + Ollama enables local semantic search.