Security audit

Local Rag Tool Free

Security checks across malware telemetry and agentic risk

Overview

This is a local RAG/search skill, but it asks for broad local command and file authority while also mentioning export, modify/delete modes, and callback URLs without enough scoping or user-control guidance.

Install only if you are comfortable giving the agent access to search and potentially index local documents/code, and use it on explicit directories rather than broad home or workspace roots. Avoid callback URLs unless you know exactly what data would be sent, and require confirmation before any export, modification, deletion, package install, or shell command.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The skill is ներկայացված as a local file retrieval/RAG tool, but its interface includes a callback URL and troubleshooting steps involving network connectivity. This expands the trust boundary from local-only processing to potential outbound communication, which can enable unexpected data exfiltration or SSRF-like behavior if user-controlled URLs are honored.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The manifest grants exec to a skill whose stated purpose is local document indexing and semantic search, but the documentation does not narrowly justify or constrain command execution. In an agent context, unnecessary exec materially increases the attack surface by allowing prompt-influenced shell actions on the local system.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The documentation broadens the skill from retrieval/search into create/query/export and later modify/delete style operation modes without clear scope control. This mismatch increases the chance that a user invoking a search-oriented skill could trigger unintended local data creation, modification, or disclosure.

Vague Triggers

Medium

Confidence: 79% confidence
Finding: The trigger descriptions and example commands are broad and overlap with ordinary user requests such as searching documents or code. In agent systems, vague activation scope can cause accidental invocation of a powerful skill, increasing the chance of unintended file access, indexing, or command execution.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill advertises exec capability but does not clearly warn users that command execution can change files, install software, access sensitive paths, or otherwise affect the local system. Missing disclosure and consent around such a powerful capability creates a real safety and security risk in an agent-operated environment.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The document states support for create/modify/delete operations but does not warn users about risks to local files and data integrity. Users may reasonably expect a retrieval tool to be read-oriented, so silent expansion into write/delete behavior raises the likelihood of destructive or privacy-impacting misuse.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.