RAG检索增强

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:42 AM UTC
• Version: 1.0.1

Overview

This is a real RAG optimization toolkit, but it needs review because its API client can send API keys and document text to configured endpoints without validating that they are safe provider URLs.

Review before installing. Use an isolated Python environment, pin dependencies if deploying, and only configure API URLs that are HTTPS endpoints for the provider matching the key. Do not run the remote LLM or embedding features on confidential documents unless you intend that content to leave your environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/llm_client.py:446

Finding

Provider credentials and RAG content can be transmitted to an arbitrary or insecure endpoint

Content

View full analysis

= self._circuit_cooldown_seconds: logger.info("熔断器进入 half-open 状态，尝试恢复") self._circuit_state = "half_open" else: logger.warning(f"熔断器 open，跳过调用（冷却剩余 {self._circuit_cooldown_seconds - (time.time() - self._circuit_last_failure_time):.0f}s）") return "LLM 调用失败：熔断器 open" response = self._requests.post( self.api_url, headers=headers, json=data, timeout=30 ) ``` The embedding client has the same destination-validation weakness: ```python self.api_key = api_key or os.geten ...[truncated 3468 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: SKILL.md:4

Finding

Dependency installation guidance is not reproducibly pinned or hash-verified

Content

View full analysis

=1.0 - sentence-transformers>=2.2.0 - numpy>=1.21.0 - pdfplumber>=0.7.0 - pypdf>=3.0.0 - python-docx>=0.8.11 - beautifulsoup4>=4.9.0 - lxml>=4.6.0 - pytesseract>=0.3.8 - Pillow>=8.0.0 - openpyxl>=3.0.0 - networkx>=3.0 - requests>=2.0 ``` ```bash pip install requests>=2.0 pip install sentence-transformers>=2.2.0 pip install pdfplumber pypdf python-docx beautifulsoup4 lxml openpyxl pytesseract Pillow pip install networkx>=3.0 ``` ### Technical Analysis The declared dependencies use broad minimum-version constraints, while several installation examples do not specify any version. No lock file or hash-verified requirements file is present in the reviewed project. These package names correspond to established packages, and the audit found no suspicious custom package index, VCS URL, direct archive URL, or apparent typosquatted dependency. The risk arises from non-reproducible resolution: a future installation can select package and transitive-dependency versions that were never reviewed with this Skill. Python packages and their transitive dependencies may execute code during installation or when imported. If an upstream release or dependency is compromised, following these commands can introduce attacker-controlled code into the user’s Python environment. ### Attack Path 1. A user follows the documented installation instructions at a later date. 2. `pip` resolves the broad constraints against the configured package index. 3. A newer direct or transitive package release is selected instead of the release originally reviewed. 4. If that release is compromised, malicious code executes during package installation or subseq ...[truncated 901 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (116)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

This mismatch is more security-relevant because the described purpose is innocuous RAG optimization, while the detected behavior includes reading environment variables and making outbound API calls. When a skill understates sensitive capabilities like credential access and network egress, reviewers and users may authorize it under false assumptions, increasing the chance of secret exposure or unintended data transmission.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

This mismatch is more security-relevant because the described purpose is innocuous RAG optimization, while the detected behavior includes reading environment variables and making outbound API calls. When a skill understates sensitive capabilities like credential access and network egress, reviewers and users may authorize it under false assumptions, increasing the chance of secret exposure or unintended data transmission.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This mismatch is more security-relevant because the described purpose is innocuous RAG optimization, while the detected behavior includes reading environment variables and making outbound API calls. When a skill understates sensitive capabilities like credential access and network egress, reviewers and users may authorize it under false assumptions, increasing the chance of secret exposure or unintended data transmission.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This mismatch is more security-relevant because the described purpose is innocuous RAG optimization, while the detected behavior includes reading environment variables and making outbound API calls. When a skill understates sensitive capabilities like credential access and network egress, reviewers and users may authorize it under false assumptions, increasing the chance of secret exposure or unintended data transmission.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

This mismatch is more security-relevant because the described purpose is innocuous RAG optimization, while the detected behavior includes reading environment variables and making outbound API calls. When a skill understates sensitive capabilities like credential access and network egress, reviewers and users may authorize it under false assumptions, increasing the chance of secret exposure or unintended data transmission.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

This mismatch is more security-relevant because the described purpose is innocuous RAG optimization, while the detected behavior includes reading environment variables and making outbound API calls. When a skill understates sensitive capabilities like credential access and network egress, reviewers and users may authorize it under false assumptions, increasing the chance of secret exposure or unintended data transmission.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This mismatch is more security-relevant because the described purpose is innocuous RAG optimization, while the detected behavior includes reading environment variables and making outbound API calls. When a skill understates sensitive capabilities like credential access and network egress, reviewers and users may authorize it under false assumptions, increasing the chance of secret exposure or unintended data transmission.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

This mismatch is more security-relevant because the described purpose is innocuous RAG optimization, while the detected behavior includes reading environment variables and making outbound API calls. When a skill understates sensitive capabilities like credential access and network egress, reviewers and users may authorize it under false assumptions, increasing the chance of secret exposure or unintended data transmission.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 275)May include surrounding context.

md

**脚本调用**：`scripts/document_preprocessor.py`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 410)May include surrounding context.

md

**脚本调用**：`scripts/document_preprocessor.py`

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api_class_reference.md (reported line 75)May include surrounding context.

bash

pip install python-dotenv>=1.0   # 一次性安装
# 然后在项目根目录的 .env 中写入 NVIDIA_API_KEY / NVIDIA_API_URL
# evaluate.py 启动时自动加载并桥接到豆包协议

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api_reference.md (reported line 682)May include surrounding context.

bash

pip install python-dotenv>=1.0   # 一次性安装
# 然后在项目根目录的 .env 中写入 NVIDIA_API_KEY / NVIDIA_API_URL
# evaluate.py 启动时自动加载并桥接到豆包协议

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api_reference.md (reported line 697)May include surrounding context.

bash

pip install python-dotenv>=1.0   # 一次性安装
# 然后在项目根目录的 .env 中写入 NVIDIA_API_KEY / NVIDIA_API_URL
# evaluate.py 启动时自动加载并桥接到豆包协议

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api_reference.md (reported line 716)May include surrounding context.

bash

pip install python-dotenv>=1.0   # 一次性安装
# 然后在项目根目录的 .env 中写入 NVIDIA_API_KEY / NVIDIA_API_URL
# evaluate.py 启动时自动加载并桥接到豆包协议

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api_reference.md (reported line 728)May include surrounding context.

bash

pip install python-dotenv>=1.0   # 一次性安装
# 然后在项目根目录的 .env 中写入 NVIDIA_API_KEY / NVIDIA_API_URL
# evaluate.py 启动时自动加载并桥接到豆包协议

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/global-operations.md (reported line 61)May include surrounding context.

bash

pip install python-dotenv>=1.0   # 一次性安装
# 然后在项目根目录的 .env 中写入 NVIDIA_API_KEY / NVIDIA_API_URL
# evaluate.py 启动时自动加载并桥接到豆包协议

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/global-operations.md (reported line 85)May include surrounding context.

bash

pip install python-dotenv>=1.0   # 一次性安装
# 然后在项目根目录的 .env 中写入 NVIDIA_API_KEY / NVIDIA_API_URL
# evaluate.py 启动时自动加载并桥接到豆包协议

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/global-operations.md (reported line 93)May include surrounding context.

bash

pip install python-dotenv>=1.0   # 一次性安装
# 然后在项目根目录的 .env 中写入 NVIDIA_API_KEY / NVIDIA_API_URL
# evaluate.py 启动时自动加载并桥接到豆包协议

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/quickstart.md (reported line 14)May include surrounding context.

bash

pip install python-dotenv>=1.0   # 一次性安装
# 然后在项目根目录的 .env 中写入 NVIDIA_API_KEY / NVIDIA_API_URL
# evaluate.py 启动时自动加载并桥接到豆包协议

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/quickstart.md (reported line 120)May include surrounding context.

bash

pip install python-dotenv>=1.0   # 一次性安装
# 然后在项目根目录的 .env 中写入 NVIDIA_API_KEY / NVIDIA_API_URL
# evaluate.py 启动时自动加载并桥接到豆包协议

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/evaluate.py (reported line 28)May include surrounding context.

python

```bash
pip install python-dotenv>=1.0   # 一次性安装
# 然后在项目根目录的 .env 中写入 NVIDIA_API_KEY / NVIDIA_API_URL
# evaluate.py 启动时自动加载并桥接到豆包协议
```

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/evaluate.py (reported line 61)May include surrounding context.

python

```bash
pip install python-dotenv>=1.0   # 一次性安装
# 然后在项目根目录的 .env 中写入 NVIDIA_API_KEY / NVIDIA_API_URL
# evaluate.py 启动时自动加载并桥接到豆包协议
```

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/evaluate.py (reported line 89)May include surrounding context.

python

```bash
pip install python-dotenv>=1.0   # 一次性安装
# 然后在项目根目录的 .env 中写入 NVIDIA_API_KEY / NVIDIA_API_URL
# evaluate.py 启动时自动加载并桥接到豆包协议
```

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/evaluate.py (reported line 199)May include surrounding context.

python

```bash
pip install python-dotenv>=1.0   # 一次性安装
# 然后在项目根目录的 .env 中写入 NVIDIA_API_KEY / NVIDIA_API_URL
# evaluate.py 启动时自动加载并桥接到豆包协议
```

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/llm_client.py (reported line 22)May include surrounding context.

python

```bash
pip install python-dotenv>=1.0   # 一次性安装
# 然后在项目根目录的 .env 中写入 NVIDIA_API_KEY / NVIDIA_API_URL
# evaluate.py 启动时自动加载并桥接到豆包协议
```

Static analysis

No suspicious patterns detected.