RAGLite - Local Expandable Library AI Library

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:49 AM UTC
• Version: 1.0.0

Overview

This skill appears purpose-built for RAG over local documents, but it should be reviewed because it installs live code from an unpinned GitHub branch and may process private documents through the default OpenClaw engine.

Review this before installing, especially if you plan to index medical, personal, school, or internal business documents. Prefer a version that pins raglite to a reviewed commit or release, and confirm whether OpenClaw condensation sends document contents to a local gateway, a private network service, or an external provider before using sensitive files.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: scripts/install.sh:14

Finding

Installation Executes an Unpinned Remote Dependency from a Mutable Branch

Content

View full analysis

Vulnerability Details

File Location: scripts/install.sh, lines 14–17
Vulnerability Type: Remote payload retrieval through an insecure dependency source
Risk Level: Medium

Vulnerable Code

bash

# Install from GitHub main (or tag) so this skill works anywhere.
python -m pip install --upgrade "git+https://github.com/VirajSanghvi1/raglite.git@main"

The preceding bootstrap command also installs mutable, unconstrained package versions:

bash

python -m pip install --upgrade pip setuptools wheel >/dev/null

Technical Analysis

The installer retrieves RAGLite directly from the mutable main branch of an external GitHub repository. It does not pin the dependency to an immutable commit, verify a cryptographic hash or signature, or otherwise ensure that the downloaded source matches the version reviewed during this audit.

A future change to the branch therefore changes the effective code installed by this Skill without requiring any modification to the audited package. During installation, Python packaging mechanisms may execute code supplied by the package's build backend. The installed raglite executable is subsequently invoked by scripts/raglite.sh.

The unconstrained upgrade of pip, setuptools, and wheel further reduces reproducibility, although no evidence establishes that those legitimate package names are currently malicious.

Attack Path

1. An attacker compromises the upstream RAGLite repository, a maintainer account, or another mechanism capable of modifying its main branch.
2. The attacker commits malicious package or build-backend code to that branch.
3. A user runs ./scripts/install.sh.
4. pip retrieves the current, attacker-modified branch without verifying an expected commit or artifact hash.
5. Malicious build code may execute during installation, or the malicious package is placed in the Skill's virtual environment.
6. The payload runs with the installing user's privileges during installation ...[truncated 754 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin RAGLite to a reviewed, immutable Git commit rather than main, for example:

   bash

   python -m pip install \
     "git+https://github.com/VirajSanghvi1/raglite.git@<full-reviewed-commit-sha>"
   

2. Prefer a versioned wheel from a controlled release process and verify it with a cryptographic hash:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

3. Pin pip, setuptools, and wheel to reviewed versions instead of upgrading them without constraints. Where practical, verify their package hashes as well.

4. Generate and maintain a lock file containing exact versions and hashes for all transitive dependencies.

5. Establish an explicit update process in which dependency revisions are audited, hashes are regenerated, and the Skill version is incremented before deployment.

6. Consider installing with build isolation and network restrictions appropriate to the environment, and avoid running the installer with elevated privileges.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The skill advertises local RAG functionality, but its installation flow pulls and installs code directly from a GitHub repository at runtime. That introduces undeclared network access and remote code execution risk via the dependency source, which is especially dangerous for a skill marketed for sensitive local/private data handling.

Content

No source excerpt is available for this finding.

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 85% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

md

2) **Index** locally into Chroma
3) **Query** with hybrid retrieval (vector + keyword)

It doesn’t replace memory/context — it’s the place to store what you need again.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill is positioned as local-first and highlights private/sensitive documents, but it does not clearly warn users that condensation may send document contents to external services such as the OpenClaw Gateway. Users may reasonably assume all processing remains local, causing unintended disclosure of sensitive data during indexing or summarization.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The install script performs a live installation from a mutable GitHub branch (@main), which introduces an unpinned supply-chain dependency at install time. Anyone who can modify the upstream repository, a compromised maintainer account, or a transient malicious commit could cause arbitrary code to run during installation in the user's environment.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The comment states the setup is isolated in a local virtual environment, but that framing omits the fact that the script fetches code from a remote GitHub repository. While the misleading comment is not dangerous by itself, it can reduce operator scrutiny and make the remote code execution risk from installation less obvious.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.