Security audit

rag-ingest

Security checks across malware telemetry and agentic risk

Overview

The skill does what it claims for RAG ingestion, but its credential and data-handling defaults deserve review before use.

Install only if you are comfortable sending ingested text to the configured embedding provider and storing it persistently in Qdrant. Set EMBED_BASE_URL and EMBED_API_KEY explicitly, avoid relying on OPENAI_API_KEY unless the endpoint is actually OpenAI, and use unique doc_id values or backups for important collections.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The script advertises itself as write-only ingestion, but it unconditionally deletes all existing Qdrant points for the same doc_id before inserting new ones. This creates a destructive side effect that can cause data loss or accidental overwrite if the caller reuses a doc_id, provides incomplete content, or ingestion fails after deletion.

Description-Behavior Mismatch

Low

Confidence: 87% confidence
Finding: The code sends document chunks to an external embedding API, which contradicts the description implying only Qdrant writes are performed. This can expose sensitive or proprietary content to a third-party service without sufficiently prominent disclosure at the time of use.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill description says it writes processed text into Qdrant and requires an embedding API key, but it does not clearly warn users that document content and source metadata may be sent to external embedding and vector-storage services. This can cause operators to ingest sensitive or regulated data without informed consent, creating confidentiality, compliance, and data-handling risks.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: User-provided content is transmitted to an external embedding service without an explicit warning or confirmation at the point of transmission. In an ingestion pipeline, this is dangerous because operators may assume content stays local except for Qdrant storage, leading to unintended disclosure of confidential data.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The script deletes existing points for the document automatically and without confirmation. If a doc_id collides, content is partial, or the subsequent embedding/upsert step fails, prior data can be irreversibly removed, making this a meaningful integrity risk.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/ingest.mjs:30