ClawHub
Back to skill

Security audit

local-rag-builder

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its RAG-building purpose, but its unauthenticated Web UI and model-download code create high-impact security risks.

Install only if you are comfortable reviewing and hardening the code first. Do not expose the Web UI on a shared network; bind it to loopback, add authentication, avoid custom model identifiers from untrusted sources, pin dependencies, and use only trusted LLM endpoints because RAG context may be sent there.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (7)

T01 · Skill Instruction Hijacking

Error
Location
scripts/rag_web_ui.py:925
Finding

Unauthenticated Persistent Prompt Hijacking

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/rag_web_ui.py:1143
Finding

Unauthenticated Administrative Web Server Exposed on All Network Interfaces

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/embedding_model_manager.py:168
Finding

Arbitrary Python Code Execution Through Crafted Model Identifier

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/rag_web_ui.py:49
Finding

Path Traversal in Configuration Template Save, Load, and Delete Operations

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/rag_standalone.py:48
Finding

Arbitrary LLM Destination Enables SSRF and Knowledge-Base Data Disclosure

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/rag_web_ui.py:86
Finding

Stored Script Injection Through Unescaped Prompt and Configuration Rendering

Content
View full analysis
... {template} ... """ ``` ### Technical Analysis Persistent prompt content is inserted directly into an HTML textarea without context-aware escaping. An attacker-controlled value containing a closing textarea tag followed by executable markup can escape the intended element and inject script into the generated page. The prompt can be remotely modified through the unauthenticated `/api/prompt` endpoint, making the issue remotely seedable. Similar risks apply wherever configuration values or dynamically registered labels are placed into HTML attributes or JavaScript without escaping. ### Attack Path 1. The attacker submits a prompt containing HTML that closes the textarea and introduces a script element. 2. The server persists the prompt. 3. An administrator opens or reloads the Web panel. 4. `generate_html()` embeds the stored value directly into the response. 5. The browser parses the injected markup and executes the attacker's script in the Web UI origin. 6. The script can call same-origin administrative endpoints and modify persistent application state. ### Impact Assessment The attacker gains script execution in the browser context of the Web UI. The script can invoke same-origin configuration APIs, alter prompts and settings, reset application state, and access information rendered by the panel. The issue does not directly provide native code execution, but it compounds the unauthenticated administrative exposure. ]]>
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
scripts/rag_env_setup.py:28
Finding

Unpinned Automatic Installation of Large Third-Party Dependency Set

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (54)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

This finding is strengthened by the document itself acknowledging an independent mode that calls external LLM services, while branding the skill as a local RAG builder. Misrepresenting external dependency and local-only expectations can expose private documents or prompts to unintended network endpoints if a user assumes the system is fully local and isolated.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

This finding is strengthened by the document itself acknowledging an independent mode that calls external LLM services, while branding the skill as a local RAG builder. Misrepresenting external dependency and local-only expectations can expose private documents or prompts to unintended network endpoints if a user assumes the system is fully local and isolated.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

This finding is strengthened by the document itself acknowledging an independent mode that calls external LLM services, while branding the skill as a local RAG builder. Misrepresenting external dependency and local-only expectations can expose private documents or prompts to unintended network endpoints if a user assumes the system is fully local and isolated.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

This finding is strengthened by the document itself acknowledging an independent mode that calls external LLM services, while branding the skill as a local RAG builder. Misrepresenting external dependency and local-only expectations can expose private documents or prompts to unintended network endpoints if a user assumes the system is fully local and isolated.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md
> 📚 **渐进式加载**：本技能采用渐进式 MD 体系，`SKILL.md` 为入口（≤230行），详细内容拆分到 `references/*.md` 按需加载。

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.

md
python scripts/rag_web_ui.py

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

md
python scripts/rag_web_ui.py

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

md
python scripts/rag_web_ui.py

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/embedding_model_manager.py (reported line 192)May include surrounding context.

python
def _download_with_hf_mirror(model_id, cache_dir):
    """使用 HuggingFace 镜像下载"""
    env = os.environ.copy()
    env["HF_ENDPOINT"] = "https://hf-mirror.com"
    script = f"""
import os, sys

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill advertises operational capabilities such as environment repair, package installation, model downloads, web UI launch, and knowledge-base management, which imply shell, filesystem, environment, and network access, yet it does not declare an explicit tool scope. This creates a permission-transparency gap: a host agent or reviewer may underestimate what the skill can cause, increasing the chance of unintended execution of high-effect actions like installs, downloads, and file writes.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest description, trigger list, and negative triggers are entirely specified in Chinese, which indicates the skill is designed to activate and operate only for Chinese-language inputs. The file does not offer an opt-in language choice or explain a justified region-specific constraint, so this is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file is written entirely in Chinese, including all architectural descriptions and operational notes, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. The policy requires flagging language or locale constraints when they are imposed without user opt-in or a clear documented justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document title, example queries, comments, and prompt templates are all presented in Chinese, and the usage examples hard-code Chinese queries such as "什么是 RAG？". This indicates a language-specific interaction pattern without any opt-in, alternative locale, or explanation that the skill is intended only for a Chinese-language context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document title and all instructions are written in Chinese, but the guide does not state that Chinese is optional, user-selectable, or required for a specific regional purpose. Under the language/locale policy, this can be a natural-language policy violation because it imposes a specific locale without user opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The guide documents a destructive deletion command for knowledge bases without warning that it removes stored data. In an agent or copy-paste workflow, users may run the command assuming it is reversible or harmless, leading to accidental data loss of indexed documents and configuration associated with that knowledge base.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
77% confidence
Finding

The guide explicitly states that skill mode makes no external HTTP requests, creating a strong safety guarantee for agent integrations. In the same documented interface, it also exposes an import operation without clearly constraining inputs to local files; if that operation accepts remote URLs or fetches remote content, integrators may unknowingly permit outbound network access under a 'no HTTP' assumption.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The guide walks users through configuring and verifying external LLM endpoints without warning that prompts, retrieved context, and possibly sensitive local knowledge-base content may be sent to that service. In a RAG skill, this is especially relevant because retrieved documents can contain proprietary or personal data, so omission of the privacy boundary can lead to unintentional data disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The remove_model function performs shutil.rmtree on the stored model path, which is a destructive file deletion operation. Although the CLI later prints the result, there is no confirmation prompt, pre-deletion warning, or explicit user-facing disclosure in the function itself before the irreversible action occurs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

Natural-language strings throughout the module, including the top-level description and user-facing CLI help/output, are written only in Chinese. The file does not offer a language/locale option or explain that the tool is intentionally restricted to a Chinese-speaking environment, which can violate language-choice policy.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium
Category
Dangerous Code Execution
Confidence
75% confidence
Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/knowledge_base_manager.py (reported line 56)May include surrounding context.

python
entry = {
        "path": kb_path,
        "description": description,
        "created": str(__import__("datetime").datetime.now()),
        "doc_count": 0,
    }
    if model_id:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The delete_knowledge_base function performs an unconditional shutil.rmtree() on a path taken from the persisted knowledge base index, with no path validation, confirmation, or confinement check that the target remains under KB_DIR. If the index file is corrupted, manually edited, or influenced elsewhere in the application, deletion could recursively remove arbitrary filesystem locations, causing severe data loss.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The lock cleanup logic automatically deletes files and directories under the pip cache heuristic once they appear stale, without strong validation that the targets are genuine pip lock artifacts. In an agent-operated local environment, automatic deletion increases the risk of accidental data loss or removal of attacker-planted paths if directory contents are manipulated.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/rag_env_setup.py (reported line 168)May include surrounding context.

python
def check_pip():
    """检查 pip 是否可用"""
    try:
        result = subprocess.run(
            [get_python_path(), "-m", "pip", "--version"],
            capture_output=True, text=True, timeout=30
        )

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/rag_env_setup.py (reported line 180)May include surrounding context.

python
def list_installed():
    """列出已安装包（包名统一转为小写+连字符格式便于匹配）"""
    try:
        result = subprocess.run(
            [get_python_path(), "-m", "pip", "list", "--format=columns"],
            capture_output=True, text=True, timeout=30
        )

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
89% confidence
Finding

This subprocess.Popen path executes python -m pip install ... where package names and mirror URLs can be influenced by CLI input (--mirror, optional package names) and are used to perform network-based package installation. While it is not shell injection, it is a genuine supply-chain risk because the script can fetch and install arbitrary packages from attacker-chosen indexes or package names, modifying the environment and potentially executing untrusted package install code.

Content

Scanner excerpt · scripts/rag_env_setup.py (reported line 235)May include surrounding context.

python
os.makedirs(LOG_DIR, exist_ok=True)

    try:
        proc = subprocess.Popen(
            cmd,
            stdout=subprocess.PIPE,
            stderr=subprocess.STDOUT,

Static analysis

Detected: suspicious.autonomous_credential_egress

Autonomous schedule or loop submits credential-bearing agent output without per-call consent.

Critical
Code
suspicious.autonomous_credential_egress
Location
scripts/rag_standalone.py:78