RAGFlow Skill

• Outcome: Pass
• Latest audit: Aug 25, 2026 · 1:39 AM UTC
• Version: 1.8.0

Overview

This is a disclosed RAGFlow administration skill that can make real changes to a configured server, but its sensitive capabilities match its stated purpose.

Install this only for a RAGFlow server you intend the agent to administer. Use HTTPS, a dedicated rotatable RAGFlow API key, and review any delete, provider, connector, embed-token, or log-level operation before allowing it to run on production data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill explicitly requires environment variables and is designed to operate against a remote RAGFlow server, which implies access to secrets and networked side effects, yet it declares no explicit permissions boundary. This can lead to overbroad execution in environments that rely on permission metadata for enforcement or review, making secret access and remote mutation less visible and less controlled.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: This client includes system-token creation, listing, reuse, and deletion plus embedded chatbot/agent access flows that extend beyond ordinary dataset/document administration into delegated access management. In a skill intended to operate a RAGFlow deployment, this broadens capability to mint or reuse bearer tokens for embedded endpoints, increasing the blast radius if the skill is invoked with untrusted prompts or over-broad permissions.

Context-Inappropriate Capability

Medium

• Confidence: 76% confidence
• Finding: Provider and provider-instance administration enables changing upstream model backends, credentials, connectivity, and model availability, which is a broader control plane than the manifest's core RAGFlow dataset/agent operations suggest. That matters because a user invoking this skill for routine RAG tasks may unknowingly grant it the ability to reconfigure backend AI infrastructure or connect to unintended external services.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The skill metadata advertises a broad operational scope across many RAGFlow functions, which can cause the agent to invoke this skill in situations that are only loosely related to the user's request. Over-broad activation increases the chance of unnecessary access to deployment-management capabilities and expands the blast radius if downstream skill behaviors are unsafe or misused.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Key Constraints

- **Confirm destructive scope.** Confirm the exact target before any `delete-*` command or before `update-metadata` deletes metadata or selects every document. Skip confirmation only when removing temporary resources created in the same requested workflow.
- **Choose the ingestion path first.** For built-in chunking, upload documents, adjust their parser configuration when needed, then run `start-parsing`. For ingestion-pipeline datasets, use `ingest-documents` instead.
- **Preserve source filenames.** When an attachment is stored under a temporary or task-generated path, upload it as `--files <original-name>=<path>` so RAGFlow retains the user-facing name.
- **Resolve complete, stable inputs.** Discover resource IDs with the corresponding `list-*` or `get-*` command, and paginate beyond RAGFlow's 100-item list limit. Use `<model>@<provider>` identifiers from `list-models` for `--embedding-model` and `--llm-id`; treat numeric model row IDs as display data only.

• Confidence: 76% confidence
• Finding: The instruction to skip confirmation when deleting temporary resources created in the same workflow authorizes autonomous destructive action based on the agent's own judgment of what is 'temporary' and in-scope. In a skill that manages datasets, documents, chats, agents, connectors, and provider instances over a live API, that can cause unintended deletion if the workflow state is misidentified or resource selection is wrong.

VirusTotal

61/61 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.