LightRAG Memory

• Outcome: Pass
• Latest audit: May 27, 2026 · 10:31 PM UTC
• Version: 1.0.1

Overview

This skill appears to do what it claims: create a semantic memory index using a local LightRAG store and an OpenAI-compatible API.

Install in a virtual environment, review or pin the Python dependencies before use, and treat anything you index as data that may be sent to your configured OpenAI-compatible provider. Use a dedicated API key, verify OPENAI_BASE_URL if set, and only run index or insert against files you are comfortable storing locally and sending for embedding/LLM processing.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (9)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill instructs users to index and query memory files using an OpenAI-compatible API, which means potentially sensitive memory contents may be transmitted to a third-party service. Without a clear privacy and data-disclosure warning, operators may unknowingly expose confidential workspace notes, user data, or internal project information.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill sends inserted text and query content to remote embedding and LLM endpoints, but the CLI provides no explicit disclosure, consent prompt, or redaction controls before transmitting potentially sensitive memory data. In a memory-management skill, this is significant because users may assume local semantic indexing while the tool actually exfiltrates workspace memory contents to an external provider.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

lightrag-hku
openai
python-dotenv
numpy

• Confidence: 92% confidence
• Finding: The dependency lightrag-hku is unpinned, which makes builds non-reproducible and allows an unexpected upstream release to be installed later. In this skill context, that is more dangerous because the package is already flagged with multiple serious advisories, so leaving the version unconstrained increases the chance of silently pulling a vulnerable or maliciously compromised release.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

lightrag-hku
openai
python-dotenv
numpy

• Confidence: 87% confidence
• Finding: The openai package is unpinned, so future installations may resolve to different versions with behavioral, security, or API-surface changes. While no specific advisory is listed here, unpinned dependencies in agent skills can still increase supply-chain risk and make security review unreliable over time.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

lightrag-hku
openai
python-dotenv
numpy

• Confidence: 91% confidence
• Finding: The python-dotenv package is unpinned, so deployments may pick up an unintended version, including one affected by file-overwrite issues. In a memory-management skill that may manipulate local files and environment configuration, this raises the chance of introducing exploitable filesystem behavior unexpectedly.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

lightrag-hku
openai
python-dotenv
numpy

• Confidence: 89% confidence
• Finding: The numpy dependency is unpinned, which exposes the project to unpredictable upgrades and known-vulnerable versions being installed depending on environment state. Because numpy has a long advisory history and is a foundational package, this weakens supply-chain assurance even if direct exploitability depends on how the library is used.

Known Vulnerable Dependency: lightrag-hku — 3 advisory(ies): CVE-2026-39413 (lightrag-hku: JWT Algorithm Confusion Vulnerability ); CVE-2026-30762 (LightRAG: Hardcoded JWT Signing Secret Allows Authentication Bypass); CVE-2025-6773 (HKUDS LightRAG allows Path Traversal via function upload_to_input_dir)

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: Including lightrag-hku without constraining to a fixed, patched release is a true vulnerability because the package is associated with authentication bypass, JWT algorithm confusion, and path traversal advisories. This is especially concerning in a semantic memory skill, which may handle sensitive agent data and file ingestion, making unauthorized access or filesystem traversal materially dangerous.

Known Vulnerable Dependency: python-dotenv — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 81% confidence
• Finding: The finding is likely valid because python-dotenv has a cited symlink-following issue in set_key that can enable arbitrary file overwrite under certain conditions. The impact is lower here because exploitability depends on the skill actually invoking the vulnerable file-writing path and on local filesystem preconditions, which are not shown in this file alone.

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 62% confidence
• Finding: This is partially credible but overstated as presented: numpy has had historical advisories, but a requirements entry alone does not prove the installed version is vulnerable or that the vulnerable code paths are reachable. Still, because the dependency is unpinned, the project has weak assurance against resolving to an affected version, so there is a real dependency risk even if the 'critical' severity may be inflated for this specific file.

Static analysis

No suspicious patterns detected.