Security audit

RAG检索增强

Security checks across malware telemetry and agentic risk

Overview

This is legitimate RAG optimization tooling, but it should be reviewed because it can send evaluation data and raw document/query text to external LLMs with limited opt-in and privacy scoping.

Install only if you are comfortable with RAG content being processed by external LLM providers, especially Anthropic in the evaluator. Before using it on private, regulated, or customer data, disable remote judging unless needed, pass only approved LLM clients, redact sensitive document text, and handle API keys through environment variables or a secrets manager.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The evaluator enables external LLM judging by default and is configured to send evaluation inputs to Anthropic. That means queries, expected answers, generated answers, and potentially source-derived content can leave the local environment without explicit opt-in, which creates a real data exfiltration and privacy/compliance risk in an evaluation tool.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: These functions transmit full evaluation artifacts to an external API, including query text, answer text, expected answer content, and concatenated source context. In a RAG setting, source context may contain proprietary knowledge-base documents or regulated data, so this creates an undocumented outbound data path that can leak sensitive material during routine evaluation.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger description is very broad, covering general RAG optimization, evaluation, retrieval accuracy, hallucination reduction, and knowledge-base QA. Such wide matching criteria increase the chance of accidental activation on common user requests, which can route conversations into a high-capability skill unexpectedly and expose files, scripts, or networked components when the user did not intend to invoke them.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The document shows API key configuration examples but provides no guidance against hardcoding secrets, checking them into source control, or exposing them in logs. In operational documentation, omission of secret-handling warnings can lead users to copy unsafe patterns directly into production code or shared config files.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The script sends user and system evaluation data to a third-party API without any user-facing warning, consent flow, or disclosure at runtime. Lack of transparency increases the likelihood that operators will unknowingly submit confidential prompts, gold answers, or retrieved source passages to an external processor, which is a security and privacy issue.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The extractor sends raw document text to an LLM for proposition extraction without any visible consent, redaction, or policy gate. In a production RAG pipeline this can expose sensitive internal documents, personal data, or regulated content to an external model provider, creating confidentiality and compliance risk.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The reference resolver transmits paragraph context and proposition text to the LLM, which may include sensitive surrounding material beyond the minimal text needed. Because this happens automatically during chunking, users may unknowingly leak confidential context to a third-party service.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The code sends both the user query and a document segment to an LLM for scoring, but provides no consent gate, disclosure, or configuration guard to prevent sensitive content from being transmitted to an external model provider. In a RAG optimization skill, documents may contain proprietary, regulated, or personal data, so silent exfiltration to a third-party LLM creates a real confidentiality and compliance risk.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The reference-resolution step sends up to 500 characters of surrounding document context plus the segment text to an LLM, again without any warning or restriction. Because this feature is specifically designed to inspect context for entity resolution, it can expose more sensitive surrounding text than the user may expect, increasing the chance of leaking confidential source material.

Ssd 3

Medium

Confidence: 91% confidence
Finding: The guidance to record the full chain of query, retrieval results, generation prompt, and answer can capture sensitive user inputs, proprietary context, and hidden system prompts in logs. If these logs are broadly accessible, retained too long, or reused for debugging without controls, they create a meaningful data leakage and privacy risk.

Ssd 3

Medium

Confidence: 95% confidence
Finding: Collecting historical queries, feedback, and identity information to build user profiles encourages broad retention and aggregation of potentially sensitive personal data. In a RAG system, user queries may contain confidential business, health, financial, or support data, so profiling without strong minimization and consent controls increases privacy and breach exposure.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The long-term memory recommendation explicitly promotes storing user history for future responses, which can turn transient interactions into persistent records. This expands the blast radius of any compromise and raises the chance that sensitive past inputs will be surfaced later, leaked through retrieval, or retained beyond user expectations.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.