ClawHub
Back to skill

Security audit

rag-ingest

Security checks for vulnerabilities and agentic risk

Overview

The skill performs the intended vector ingestion, but its defaults can send document text and an OpenAI API key to a non-OpenAI embedding service without clear warning.

Review before installing. Use only dedicated, low-privilege embedding keys, explicitly set both EMBED_BASE_URL and the matching API key, avoid running it in environments containing unrelated OPENAI_API_KEY values, and do not ingest confidential data unless you accept sending chunks to the configured embedding service and storing them in Qdrant.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/ingest.mjs:29
Finding

OpenAI API Credential Disclosed to an Unrelated Default Embedding Provider

Content
View full analysis
d.embedding); } ``` ### Technical Analysis The embedding service URL and API credential are selected independently. Unless `EMBED_BASE_URL` is explicitly configured, the script sends requests to `https://api.vectorengine.ai/v1`. However, if neither `VECTORENGINE_API_KEY` nor `EMBED_API_KEY` exists, it silently uses `OPENAI_API_KEY`. Consequently, a credential named and ordinarily scoped for OpenAI is placed in an HTTP `Authorization` header and transmitted to the unrelated `api.vectorengine.ai` host. The remote host necessarily receives the bearer credential before it can accept or reject the request. The request body also contains every generated document chunk in the `input` property. Sending document content to an embedding provider is necessary for remote embedding, but using an unrelated default endpoint and silently forwarding another provider's credential is not necessary. The behavior is not fully disclosed ...[truncated 1989 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill declares required environment variables and, by its purpose, performs networked writes to Qdrant and an embedding service, but it does not declare an explicit tool/permission scope. This weakens reviewability and consent boundaries because an agent or operator cannot easily see from the manifest that the skill exfiltrates provided content to external services and uses network capabilities.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The description says the skill writes processed text into Qdrant and requires an embedding API key, but it does not clearly warn users that supplied content will be transmitted to external services and stored in a vector database. This creates a real risk of unintentional disclosure of sensitive, proprietary, or regulated data because users may provide content without understanding the storage and third-party processing implications.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The code hardcodes an external embedding API as the default endpoint, making third-party transmission the out-of-box behavior. This increases the chance of sensitive text being exfiltrated outside the local environment, particularly because the skill description emphasizes ingestion into Qdrant and may not make remote processing obvious to operators.

Content

Scanner excerpt · scripts/ingest.mjs (reported line 32)May include surrounding context.

js
const QDRANT_URL = process.env.QDRANT_URL || "http://127.0.0.1:6333";
const EMBED_BASE_URL =
  process.env.EMBED_BASE_URL || "https://api.vectorengine.ai/v1";
const EMBED_API_KEY =
  process.env.VECTORENGINE_API_KEY ||
  process.env.EMBED_API_KEY ||

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script sends document content chunks to an external embedding service by default, which can expose sensitive or proprietary data to a third party without any runtime disclosure, consent gate, or policy enforcement. In an ingestion skill, this is especially relevant because users may assume the tool only writes to local Qdrant, while the actual design transmits full text off-host for embedding.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The script automatically deletes all existing points matching the provided doc_id before upserting new ones, with no confirmation or dry-run mode. If a user supplies the wrong doc_id or invokes the tool unexpectedly in automation, this can cause silent data loss or unauthorized overwrite of knowledge-base contents.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The file-level documentation at L006-L007 says the tool only chunks, embeds, and writes provided正文, and explicitly says it does not perform refinement. However, the stored payload sets text_type to "summary", which semantically represents refined/summarized content rather than raw正文 chunks. This is an active documentation-to-code contradiction because downstream consumers will be told the stored text is a summary when the code is actually storing chunked source text.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The natural-language instructions and parameter descriptions are presented exclusively in Chinese, which can impose a language requirement on users without opt-in. The file does not indicate that the skill is intentionally region-specific or provide an alternative language option.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/ingest.mjs:30