Security audit

Ai Rag Pipeline

Security checks for vulnerabilities and agentic risk

Overview

This RAG skill is mostly coherent, but its primary setup path asks users to execute a mutable remote installer directly in a shell.

Review before installing. Prefer a manual, pinned, checksum- or signature-verified CLI installation instead of running the pipe-to-shell Quick Start, and avoid sending secrets, private documents, or confidential URLs through the example search and LLM workflows unless those providers are approved for that data.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:16
Finding: Mutable Remote Installer Is Piped Directly into a Shell
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:286
Finding: Unpinned Third-Party Skill Installation Through npx
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: The command curl -fsSL https://cli.inference.sh | sh downloads and immediately executes a remote script, which is a classic unsafe installation pattern. If the host, transport path, or served script is compromised, users will execute attacker-controlled shell code on their machine; this skill is especially sensitive because allowed-tools includes broad Bash access, normalizing shell execution for users.
Content: Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.
Quick Start

bash
curl -fsSL https://cli.inference.sh | sh && infsh login # Simple RAG: Search + LLM SEARCH=$(infsh app run tavily/search-assistant --input '{"query": "latest AI developments 2024"}')

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest description includes many broad trigger phrases such as generic research, fact-checking, citation, and knowledge retrieval terms that could match ordinary user requests and cause the skill to activate unexpectedly. In this skill, unexpected activation is more dangerous because the workflow routes prompts and retrieved content to multiple external services, increasing unintended data exposure and tool use.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill presents examples that send user queries, extracted web content, and generated prompts to external providers including search services and LLM APIs, but it does not clearly warn users about that data flow. In a research-oriented skill, users may paste sensitive internal questions, URLs, or documents, so missing disclosure materially increases the risk of accidental data exfiltration to third parties.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.