Local Rag Search

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:15 AM UTC
• Version: 0.1.0

Overview

The skill is mostly a coherent web-search helper, but its install instructions run mutable external MCP server code without pinning it to a reviewed version.

Review the MCP server source and pin the Git install to a trusted commit or the Docker image to a verified digest before installing. Avoid sending secrets, personal data, or confidential research topics through the search tools, especially when using Google or other non-private backends.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: README.md:20

Finding

Unpinned Remote MCP Server Code Is Retrieved and Executed

Content

View full analysis

Vulnerability Details

File Location: README.md:20-49
Vulnerability Type: Remote execution of mutable upstream code
Risk Level: Medium

The documented installation alternatives retrieve and execute an MCP server from mutable external references:

json

{
  "mcpServers": {
    "mcp-local-rag": {
      "command": "uvx",
      "args": [
        "--python=3.10",
        "--from",
        "git+https://github.com/nkapila6/mcp-local-rag",
        "mcp-local-rag"
      ]
    }
  }
}

json

{
  "mcpServers": {
    "mcp-local-rag": {
      "command": "docker",
      "args": [
        "run", "--rm", "-i", "--init",
        "-e", "DOCKER_CONTAINER=true",
        "ghcr.io/nkapila6/mcp-local-rag:v1.0.2"
      ]
    }
  }
}

Technical Analysis

The uvx configuration installs directly from a Git repository without specifying a reviewed commit SHA. The effective code therefore depends on the repository state when installation occurs and can change after this skill has been audited.

The Docker alternative uses the tag v1.0.2 without an immutable image digest. Container tags can potentially be reassigned to different image manifests. Consequently, the displayed version label does not cryptographically ensure that future users execute the same image reviewed by earlier users.

In both cases, the MCP client is instructed to execute remotely supplied software. Compromise of the upstream repository, publisher account, build pipeline, or container registry could replace the expected server with an attacker-controlled payload.

Attack Path

1. An attacker compromises the upstream Git repository, maintainer credentials, release pipeline, or container registry.
2. For the uvx path, the attacker changes the repository revision resolved by the unpinned Git URL. For the Docker path, the attacker replaces the manifest associated with v1.0.2.
3. A user follows the docu ...[truncated 1124 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the Git installation to a reviewed full commit SHA rather than the repository's current default revision, for example:

   text

   git+https://github.com/nkapila6/mcp-local-rag@FULL_REVIEWED_COMMIT_SHA
   

2. Pin the container image by its immutable digest:

   text

   ghcr.io/nkapila6/mcp-local-rag:v1.0.2@sha256:VERIFIED_IMAGE_DIGEST
   

3. Verify commit signatures, release provenance, and image signatures before publishing updated installation instructions.
4. Introduce a documented update process requiring review and testing before changing either pinned reference.
5. Run the MCP server with least privilege. Restrict filesystem access, credentials, environment variables, and outbound network access to what search functionality requires.
6. Configure dependency and image monitoring so maintainers can deliberately update pins when validated security releases become available.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README encourages web searching and multi-engine research but does not clearly disclose that user queries may be transmitted to third-party search providers such as DuckDuckGo, Google, Bing, and others. In an agent skill context, this can cause users or downstream agents to submit sensitive prompts, internal data, or research topics externally without informed consent, creating a meaningful privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill documentation lists the available deep_research backends as duckduckgo, google, bing, brave, wikipedia, yahoo, yandex, mojeek, and grokipedia, but the workflow example suggests backends=["google", "stackoverflow"] if available. This actively conflicts with the documented tool scope and could mislead an agent into attempting a backend not described by the skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.