Milvus

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 5:35 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward Milvus database helper with disclosed database administration abilities, though users should harden credentials and dependency installation.

Install only in an environment where you are comfortable adding pymilvus, pin or lock the dependency when possible, do not keep the example root:Milvus credential, and review any requested drop, delete, or RBAC change before allowing it to run.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17–20; related installation guidance at lines 41 and 628
Vulnerability Type: Unpinned dependency installation
Risk Level: Medium

Vulnerable Code Snippet:

yaml

install:
  - kind: uv
    package: pymilvus
    bins: []

The file also recommends the following unpinned command:

bash

pip install pymilvus

Technical Analysis

The skill declares and recommends installation of pymilvus without specifying an exact reviewed version, integrity hash, or lockfile. As a result, the package artifact installed at deployment time can differ from the artifact that existed when the skill was audited.

This creates a supply-chain risk because package installation may execute package-controlled build or installation logic with the permissions of the user or Agent environment. The audit did not find evidence that pymilvus itself is malicious; the vulnerability is the absence of version and integrity controls around a dependency obtained from an external package repository.

Attack Path

1. A user installs or invokes the skill in an environment where pymilvus is not already available.
2. The installer resolves the unconstrained package name against the configured Python package repository.
3. A future compromised, malicious, or unexpectedly incompatible release is selected automatically.
4. The package is downloaded and its installation or build logic runs locally.
5. Malicious package logic could access data and resources available to the installing process.

This path depends on compromise of the package, package repository, repository configuration, or dependency-resolution process.

Impact Assessment

A compromised dependency could execute code with the permissions of the Agent or user performing installation. Depending on the host configuration, this may permit access to local files, environment variables, database credent ...[truncated 200 chars]

Remediation

View remediation

Remediation Suggestions

• Pin pymilvus to an explicitly reviewed version rather than resolving the latest available release.
• Use a lockfile or requirements file containing cryptographic hashes, such as pip's --require-hashes workflow.
• Restrict installation to the official, explicitly configured package index and prevent unintended fallback to untrusted indexes.
• Review dependency updates before changing the pinned version and use automated vulnerability and provenance scanning.
• Install dependencies in a dedicated virtual environment with minimal filesystem and network privileges.
• Replace the generic command with a version-constrained example, such as python3 -m pip install --require-hashes -r requirements.txt.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:67

Finding

Predictable Administrative Credential in Connection Example

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 67
Vulnerability Type: Insecure hardcoded default credential example
Risk Level: Medium

Vulnerable Code Snippet:

python

client = MilvusClient(uri="http://localhost:19530", token="root:Milvus")

Technical Analysis

The connection example embeds the predictable credential root:Milvus for a privileged Milvus account. Although this is presented as documentation rather than an undisclosed production secret, users may copy the example without rotating the credential or replacing the administrative account with a least-privileged identity.

The example also places the credential directly in source code, where it can be exposed through version control, logs, process inspection, debugging output, or copied configuration. Use of the administrative account expands the consequences of credential disclosure because it may authorize database-wide management and RBAC operations.

Attack Path

1. A user copies the documented connection example into an application or automation script.
2. The Milvus deployment retains the predictable root:Milvus credential, or the credential remains embedded in source code.
3. An attacker obtains network access to the Milvus endpoint or discovers the credential in a repository, log, or deployed artifact.
4. The attacker authenticates using the privileged account.
5. Subject to the permissions assigned to that account, the attacker searches or extracts vectors, inserts or modifies records, deletes data, drops collections or databases, and changes users, roles, or privileges.

Exploitation requires the example credential to remain valid and the Milvus service to be reachable by the attacker.

Impact Assessment

Successful exploitation may provide administrative access to the affected Milvus deployment. Potential scope includes confidentiality loss for stored vectors and metadata, unauthorized modification or inser ...[truncated 270 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the literal administrative credential from the example.
• Read credentials from a secret manager or environment variable, for example token=os.environ["MILVUS_TOKEN"].
• Explicitly require rotation or disabling of default credentials before exposing Milvus to any network.
• Demonstrate a dedicated, least-privileged service account with only the collection and operation permissions required by the application.
• Keep secrets out of source control, command-line arguments, logs, and exception output.
• Prefer a secured Milvus endpoint with transport encryption and certificate validation when connecting across a network.
• Add documentation instructing users to restrict endpoint exposure with firewall rules and to audit authentication attempts and RBAC changes.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.