LightRAG Knowledge Base

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:59 AM UTC
• Version: 1.0.0

Overview

The skill is mostly transparent about building a shared agent memory, but it recommends broad cross-workspace indexing, long-lived storage, optional auto-indexing, and external model processing without enough controls.

Install only if you are comfortable centralizing the selected agents' memory into a shared, persistent graph and potentially sending indexed text to an OpenAI-compatible provider. Use explicit file allowlists, skip profile/private/security/trading logs unless reviewed, disable the cron job by default, prefer local models for sensitive data, pin the container image to a reviewed digest, and define deletion and access-control procedures before indexing real data.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:197

Finding

Unrestricted Cross-Agent Collection and Indexing of Sensitive Memory

Content

View full analysis

Remediation

View remediation

other

Error

• Location: SKILL.md:89

Finding

Agent Memory May Be Transmitted to External Model Providers Without Data Controls

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:72

Finding

Mutable Latest Container Image Creates Supply-Chain Exposure

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (13)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

volumes: - ./data:/app/data env_file: - .env

text

Create `docker/lightrag/.env`:

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

cd docker/lightrag docker compose up -d

Check it's running

curl -s http://127.0.0.1:9621/health

text

## Step 2: Create Query/Insert Scripts

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README explicitly promotes cross-agent access to shared memory ('Any agent can query what other agents learned') but does not clearly warn users that data may be visible across agent boundaries, persisted, and potentially exposed to agents with different trust levels. In a multi-agent environment, this can lead to unintended disclosure of sensitive prompts, logs, secrets, or customer data if users assume agent memory remains isolated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README advertises that knowledge and relationships 'survive forever' without prominently explaining retention risks, deletion challenges, or the consequences of storing sensitive information long-term. Persistent retention increases blast radius because accidentally indexed secrets, personal data, or confidential operational details may remain discoverable indefinitely across agents and over time.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The description says to use the skill 'when agents need to share knowledge or when memory_search is not enough,' which is an open-ended invocation condition without clear boundaries. This is broad enough to overlap with many normal agent tasks and does not provide specific trigger phrases, exclusions, or negative examples.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

Step 1: Deploy LightRAG

Create docker/lightrag/docker-compose.yml:

yaml

services:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

The configuration directs LightRAG to use https://api.openai.com/v1 for graph construction and queries. Given the skill's purpose is to ingest agent memories and shared knowledge, this means potentially sensitive internal content may be sent to an external provider, making the transmission materially risky in this context.

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

md

# LLM (for graph construction and queries)
LLM_BINDING=openai
LLM_MODEL=gpt-4.1-nano
LLM_BINDING_HOST=https://api.openai.com/v1
LLM_BINDING_API_KEY=sk-your-api-key

# Embeddings (for vector search)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

The embedding configuration sends document content to an external embedding provider, which is especially risky because the skill recommends bulk indexing of memory files and agent metadata. Embedding pipelines often process the raw text, so secrets, personal data, or strategic internal information could leave the local environment.

Content

Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.

md

EMBEDDING_BINDING=openai
EMBEDDING_MODEL=text-embedding-3-small
EMBEDDING_DIM=1536
EMBEDDING_BINDING_HOST=https://api.openai.com/v1
EMBEDDING_BINDING_API_KEY=sk-your-api-key

# Performance

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

cd docker/lightrag docker compose up -d

Check it's running

curl -s http://127.0.0.1:9621/health

text

## Step 2: Create Query/Insert Scripts

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

md

KEY = "your-secure-api-key"

def query(text, mode="mix"):
    r = requests.post(f"{API}/query",
        headers={"Authorization": f"Bearer {KEY}", "Content-Type": "application/json"},
        json={"query": text, "mode": mode, "only_need_context": False},
        timeout=30)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

The insert script sends arbitrary text into the LightRAG service for indexing, and the overall setup explicitly uses external OpenAI-compatible LLM and embedding APIs for graph construction and retrieval. Because the skill encourages indexing logs and profile files across agents, this creates a realistic pathway for sensitive internal data to be centralized and transmitted to third parties.

Content

Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.

md

KEY = "your-secure-api-key"

def insert(text, description="manual insert"):
    r = requests.post(f"{API}/documents/text",
        headers={"Authorization": f"Bearer {KEY}", "Content-Type": "application/json"},
        json={"text": text, "description": description},
        timeout=120)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs bulk ingestion of SOUL.md, USER.md, and agent memory logs from multiple workspaces into a shared knowledge graph, but the warning about sensitive data appears later and is easy to miss. In this context, the graph is also backed by OpenAI-compatible LLM/embedding services, so indexing logs can expose private cross-agent data and potentially transmit it to third-party providers.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The cron job creates ongoing automated ingestion of daily logs from multiple workspaces into the shared graph. That persistence increases blast radius: newly created sensitive entries will be exfiltrated or centrally exposed without human review, making accidental leakage much more likely over time.

Content

Scanner excerpt · SKILL.md (reported line 241)May include surrounding context.

Step 6: Auto-Index New Daily Logs (Optional)

Create a cron job to index new daily logs automatically:

bash

#!/bin/bash

Static analysis

No suspicious patterns detected.