ClawHub
Back to skill

Security audit

rag

Security checks for vulnerabilities and agentic risk

Overview

This RAG skill reads user-selected local documents and can optionally use an external LLM, with the sensitive behaviors mostly disclosed and aligned with its purpose.

Install only if you are comfortable indexing the document folders you choose. Keep the default offline mode for sensitive files, and set OPENAI_API_KEY and OPENAI_BASE_URL only when you intend retrieved excerpts and questions to be sent to that provider. Review or clear learned_patterns.json if operation notes may contain sensitive details.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (7)

Tainted flow: 'req' from os.environ.get (line 75, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers={"Authorization": f"Bearer {key}", "Content-Type": "application/json"},
    )
    try:
        with urllib.request.urlopen(req, timeout=30) as resp:
            data = json.loads(resp.read().decode("utf-8"))
        return data["choices"][0]["message"]["content"].strip()
    except Exception as e:
Confidence
91% confidence
Finding
The code constructs an outbound HTTP request using `OPENAI_BASE_URL` and `OPENAI_API_KEY` taken directly from environment variables, then sends retrieved document content and the user question to that endpoint. In this skill’s context, that creates a real exfiltration risk if the environment is misconfigured or attacker-controlled, because sensitive local knowledge-base text and credentials may be transmitted to an untrusted external service.

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill advertises capabilities that include reading local files, writing output files, accessing environment variables, and optionally making network requests, but it does not declare permissions or surface these powers to the user. This weakens transparency and consent boundaries, especially because the retrieved document contents and API credentials could be exposed to code paths the user did not explicitly approve.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The documented behavior goes beyond simple RAG and includes a learner that records each operation, result details, and persistent usage insights, which is materially different from the declared purpose. This is dangerous because it introduces hidden data collection and retention, potentially capturing sensitive prompts, document topics, failures, or user preferences without clear disclosure or consent.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
The module persistently stores user preferences, recent operations, notes, and error patterns even though that behavior is not necessary for core RAG indexing/retrieval. If sensitive prompts, document names, or workflow details are placed in capability names, notes, or preferences, they can accumulate on disk and create a privacy and data-retention risk beyond user expectations.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The skill explicitly supports sending retrieved local context to an external LLM service using API credentials, but the documentation does not warn that local document content may leave the host. In a RAG workflow this is especially sensitive because retrieved chunks often contain proprietary or personal data selected precisely for relevance to the user's question.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The code writes learning data to a local JSON file without any explicit notice, consent flow, or visibility controls. Silent persistence is risky because users may unknowingly leave sensitive operational metadata or free-form notes on disk, where other local users, backups, or later processes can access it.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The optional LLM mode sends the user’s question plus retrieved document chunks to an external API without explicit warning, consent, or a privacy gate. In a RAG skill operating over local documents, that is security-relevant because the retrieved text may contain proprietary or sensitive data that users expect to remain local.

Static analysis

No suspicious patterns detected.