local-rag-builder

• Outcome: Review
• Latest audit: Jul 11, 2026 · 4:54 AM UTC
• Version: 1.6.0

Overview

This is a real local RAG tool, but its web UI and knowledge-base deletion paths are under-scoped enough that users should review it before installing.

Install only if you are comfortable running a local tool that can install packages, download models, write and delete RAG data, and optionally send prompts/context to a configured LLM endpoint. Run the web UI bound to localhost only, avoid exposing its port to a network, back up the data directory before deleting KBs, and review or patch path validation around KB and template names before using it with untrusted inputs.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (18)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

os.makedirs(LOG_DIR, exist_ok=True)

    try:
        proc = subprocess.Popen(
            cmd,
            stdout=subprocess.PIPE,
            stderr=subprocess.STDOUT,

• Confidence: 84% confidence
• Finding: This helper executes pip install commands via subprocess.Popen, and the package name and mirror URL can be influenced by command-line input or caller-supplied values elsewhere in the script. While shell injection is mitigated by using an argv list, the function still enables installation of arbitrary packages from arbitrary indexes, which can lead to execution of untrusted code during package installation in a local environment setup tool.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
        if capture:
            # 流式模式：实时输出 + 收集完整结果
            proc = subprocess.Popen(
                cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
                bufsize=1, text=True
            )

• Confidence: 84% confidence
• Finding: This helper executes whatever command list it is given via subprocess.Popen, and the module exposes it as a generic utility without any allowlist, caller validation, or trust boundary enforcement. Even though shell=True is not used, arbitrary program execution is still possible if higher-level code passes attacker-controlled commands or arguments, which is especially risky in an agent skill that may process user-driven configuration and automation tasks.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"returncode": proc.returncode,
            }
        else:
            result = subprocess.run(
                cmd, capture_output=False, text=True, timeout=timeout
            )
            return {

• Confidence: 79% confidence
• Finding: This code path also provides arbitrary subprocess execution, here via subprocess.run with inherited stdout/stderr. The main risk is not the API itself but that the utility accepts an unrestricted cmd value and can therefore be used by any caller to launch local programs, potentially enabling command execution or unsafe side effects if inputs are attacker-influenced.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill advertises low sensitivity and low permission weight, but its documented behavior includes shell execution, environment modification, file read/write, and network downloads. This mismatch can cause the host agent or user to grant and run materially more powerful actions than expected, weakening consent and security review.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The skill is presented as a local RAG builder, but the documented functionality also includes connecting to external OpenAI-compatible LLM services, checking remote LLM connectivity, and using external LLM assistance in the Web UI. This expands the trust boundary beyond local processing and can expose prompts, retrieved content, or metadata to external endpoints contrary to user expectations.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: `create_knowledge_base()` uses the user-supplied `name` directly in `os.path.join(KB_DIR, name)` without validation or canonicalization. An attacker can supply path traversal values such as `../...` or absolute paths to create directories outside the intended knowledge-base root, which is especially risky in a local file-management skill that exposes KB creation/import workflows.

Context-Inappropriate Capability

Critical

• Confidence: 100% confidence
• Finding: `delete_knowledge_base()` reads `index[name]["path"]` and passes it to `shutil.rmtree()` with no confinement check. If the index contains a crafted path—whether from prior path traversal during creation or by tampering with `kb_index.json`—the function can recursively delete arbitrary directories on the host, making this extremely dangerous for a local RAG management tool that handles filesystem state.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The HTTP server exposes many state-changing endpoints that modify configuration, prompts, templates, and knowledge-base settings without any authentication or authorization checks. Because the server binds to all interfaces and also permits cross-origin requests, any reachable host or malicious web page can trigger persistent local configuration changes, making this more serious than a purely local convenience UI.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The recommendation endpoint sends user-supplied descriptions to an external LLM endpoint via the configured base URL, which can leak sensitive document descriptions or metadata outside the local environment. In a tool advertised as a local RAG builder, this behavior creates an unexpected confidentiality boundary crossing and could also be abused for SSRF-like access to attacker-controlled or internal services if the base URL is modified.

Intent-Code Divergence

Low

• Confidence: 89% confidence
• Finding: The file presents itself as a local settings UI, but the implementation sends Access-Control-Allow-Origin: * on JSON responses. When combined with unauthenticated state-changing endpoints, this broadens exposure by allowing browser-based cross-origin interaction from arbitrary sites, undermining the expectation that the interface is local-only.

Context-Inappropriate Capability

Medium

• Confidence: 81% confidence
• Finding: The utility module includes a broad command-execution primitive that exceeds a minimal local RAG-building helper role and increases the attack surface of the skill. In agent contexts, generic execution helpers are dangerous because they are easy for other components to reuse in unintended ways, turning data-flow bugs elsewhere into full local code execution.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The quick-start instructions encourage automatic environment repair and dependency installation without an upfront warning that these actions modify the local Python environment, create virtual environments, install packages, and write to disk. Users may run invasive commands without informed consent, increasing the chance of unintended system changes or supply-chain exposure.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The skill promotes model downloading from multiple sources but does not clearly warn that these actions contact external services and may disclose request metadata such as IP address, user agent, and requested model identifiers. In a security-sensitive or air-gapped context, this can violate user assumptions about locality and privacy.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The guide provides a direct knowledge-base deletion command without any warning that the operation may irreversibly remove stored data. In a tool that manages local RAG corpora, users may execute the example verbatim and unintentionally destroy indexed documents or associated metadata, causing data loss and operational disruption.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The script sends the user's question and retrieved knowledge-base context to an externally configured LLM endpoint without an explicit warning or consent checkpoint at the time of transmission. In a RAG system, retrieved context may contain sensitive local documents, so this can cause unintended disclosure to a remote service, especially if base_url points to a non-local or third-party endpoint.

Missing User Warnings

Medium

• Confidence: 76% confidence
• Finding: The pip_install helper performs package installation from potentially network-backed package indexes without any consent prompt, provenance check, pinning, or integrity verification in this file. In a setup skill, this can lead to supply-chain exposure or unexpected environment modification if package names or indexes are influenced by untrusted input.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: An undocumented arbitrary subprocess helper is a real safety issue in an agent skill because it hides the capability to execute local commands behind a generic utility surface. Lack of explicit disclosure makes it more likely that the capability is reused casually or exposed indirectly through user-facing flows, increasing the chance of dangerous misuse.

Unvalidated Output Injection

High

• Category: Output Handling

Content

models = json.loads(result.stdout)

# [技能模式] 纯检索（不依赖 LLM）
result = subprocess.run(
    [PYTHON, f"{SKILL_DIR}/scripts/rag_skill.py",
     "--query", "什么是 RAG？", "--json"],
    capture_output=True, text=True

• Confidence: 83% confidence
• Finding: This example captures untrusted output from a retrieval script and explicitly forwards data["context"] for an agent to answer from. In a RAG setting, retrieved context can contain prompt-injection instructions or malicious text from documents; presenting it to an agent without trust boundaries or sanitization can influence downstream model behavior and lead to data exfiltration, unsafe tool use, or policy bypass.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.autonomous_credential_egress

Autonomous schedule or loop submits credential-bearing agent output without per-call consent.

Critical

• Code: suspicious.autonomous_credential_egress
• Location: scripts/rag_standalone.py:78