ClawHub
Back to skill

Security audit

dpr_pro

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed RAGFlow management skill that can upload, search, update, and delete RAGFlow datasets and documents using a configured API key.

Install only if you trust the RAGFlow server configured in RAGFLOW_API_URL and are comfortable sending document contents, filenames, queries, and a bearer API key to it. Keep deletion limited to exact dataset or document IDs after explicit confirmation, and use dataset-specific progress checks in shared environments.

SkillSpector

Vulnerability Patterns
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Tainted flow: 'request_obj' from os.getenv (line 208, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
request_obj = urllib.request.Request(url, headers=headers, data=body, method=method)

    try:
        with urllib.request.urlopen(request_obj, timeout=HTTP_TIMEOUT) as response:
            return decode_json_response(response.read())
    except urllib.error.HTTPError as exc:
        body_bytes = exc.read()
Confidence
88% confidence
Finding
The code builds the request target from environment variables, including HOST_ADDRESS and RAGFLOW_* values, and then performs an outbound HTTP request with a Bearer API key attached. If an attacker can influence the environment or repository .env file, they can redirect requests to an arbitrary host and cause disclosure of the API key or induce SSRF-like access to internal services. In this skill context, making network requests is expected, but the ability to source the destination from mutable local configuration increases risk.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The workflow instructs the agent to inspect all datasets and documents when the user asks broad progress questions, but it does not require a privacy warning or scope confirmation first. In multi-dataset or multi-tenant contexts, this can expose names, statuses, and error details of unrelated documents the user did not explicitly ask to access.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The script exposes a destructive delete operation that can remove one or more datasets immediately based only on a provided --ids argument, with no interactive confirmation, dry-run mode, or explicit force flag. In an agent skill context, this is riskier than a normal admin CLI because an LLM or automation layer can invoke deletion from ambiguous, mistaken, or prompt-injected instructions, causing irreversible data loss.

Static analysis

No suspicious patterns detected.