Security audit
Security checks for vulnerabilities and agentic risk
This is a transparent RAGFlow administration skill that can change a configured RAGFlow server, but the sensitive behavior is disclosed and aligned with that purpose.
Install only if you intend to let Codex administer a RAGFlow deployment. Use a dedicated rotatable RAGFlow API key, prefer HTTPS, keep provider keys and embed tokens out of chat/logs, review any agent or webhook examples before deploying them, and confirm destructive commands only after checking the exact target resources.
Referenced artifact was not completely inspected
4. **A command failed?** -> Read [references/TROUBLESHOOTING.md](references/TROUBLESHOOTING.md) - common errors with causes and fixes.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
_assertDestructiveAllowed(method, endpoint, payload = {}) {
payload = payload || {};
const route = this._buildUrl(endpoint).pathname.replace(/^\/api\/v1/, "");
// DELETE /datasets/:id/chunks stops parsing; it does not delete stored chunks.
const deletesResources = method.toUpperCase() === "DELETE" && !/^\/datasets\/[^/]+\/chunks$/.test(route);
const metadataChange = /\/metadata\/update$|\/documents\/metadatas$/.test(route) &&
(Boolean(payload.deletes?.length) || !payload.selector?.document_ids?.length);
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
await client.listProviders({ available: true }); // GET /api/v1/providers?available=true
await client.getProvider("OpenAI"); // GET /api/v1/providers/OpenAI
await client.addProvider("OpenAI"); // PUT /api/v1/providers { provider_name }
await destructiveClient.deleteProvider("OpenAI"); // DELETE /api/v1/providers/OpenAI
// Discover a provider's models (some providers fetch a live list from the remote API)
await client.listProviderModels("OpenAI", { api_key: "sk-...", base_url: "" });
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
function cliErrorMessage(err) {
const message = err.message || String(err);
if (err.code === "ECONNREFUSED") {
return "Cannot connect to RAGFlow server. Check RAGFLOW_URL in .env";
}
if (err.code === "ECONNRESET") {
return "Connection reset by RAGFlow server. The server may be restarting";
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
function cliErrorMessage(err) {
const message = err.message || String(err);
if (err.code === "ECONNREFUSED") {
return "Cannot connect to RAGFlow server. Check RAGFLOW_URL in .env";
}
if (err.code === "ECONNRESET") {
return "Connection reset by RAGFlow server. The server may be restarting";
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
return "Request timed out. The server may be slow or unreachable";
}
if (message.includes("RAGFLOW_URL is required") || message.includes("RAGFLOW_API_KEY is required")) {
return `${message}. Configure .env file with RAGFLOW_URL and RAGFLOW_API_KEY`;
}
if (err.code) {
return `API Error: ${message}`;
The skill requires environment secrets and performs network-capable operations, but it does not declare an explicit tool scope such as permissions or allowed-tools. That increases the attack surface because an execution environment may grant broader access than necessary, allowing the bundled CLI to use sensitive environment variables and make arbitrary outbound requests beyond the narrowly intended RAGFlow workflows.
The skill advertises a broad capability set for routine RAGFlow operations and uses a default prompt that encourages general-purpose use of the skill whenever a deployment is involved. This can cause over-invocation of a powerful operational skill, increasing the chance that untrusted user input is routed into sensitive management actions such as dataset, agent, connector, or model operations without tighter scoping or confirmation.
This client exposes system token lifecycle operations and embedded chat/agent access paths, including creating reusable system tokens and using them as alternate auth for chatbot and agentbot endpoints. In a skill intended for ordinary RAGFlow deployment operations, bundling token issuance for embedded website access expands privilege and attack surface: misuse could create or reuse tokens that grant unintended access to embedded interfaces.
The ### Browser subsection states that Browser enables AI-driven browser automation, navigation, extraction, and interaction, but the very next lines resume describing Begin.mode = "Webhook" fields instead of Browser-specific schema or usage. This is an active documentation contradiction within the guide: the section header and descriptive text introduce one capability, while the associated instructions document another.
The system prompt instructs the agent to use retrieval for "private knowledge" but does not define what counts as private, who is authorized to access it, or when retrieval must be refused. In a RAGFlow agent that is explicitly connected to a dataset, this ambiguity can cause the model to query and disclose sensitive internal content based only on user phrasing rather than explicit authorization and policy checks.
This webhook is exposed with no authentication, no IP allowlist, and only a generic POST JSON schema requiring a single string field. That makes the endpoint callable by anyone who can reach it, enabling unsolicited triggering, log/message flooding, and potential abuse of downstream workflow behavior if this example is deployed unchanged.
This JSON manifest includes a hard-coded Chinese user-facing message while the surrounding prologue is in English, with no indication that the user can choose or opt into the language used by the skill. That can violate language/locale policy expectations because the skill imposes a locale-specific response by default.
The default value "text-embedding-v4@Tongyi-Qianwen" bakes in a specific model/provider choice that may imply a locale or organizational preference. The file does not present this as an opt-in choice or document why this locale-specific default is required for this diagnostic.
No suspicious patterns detected.