RAGLite

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:49 AM UTC
• Version: 1.0.0

Overview

This RAG skill is mostly coherent, but it needs review because it installs changing code from GitHub and is aimed at sensitive documents without fully clear data-flow warnings.

Review before installing. Use it only in an environment where you are comfortable processing the selected documents through the configured OpenClaw gateway and Chroma endpoint, and prefer a pinned, reviewed raglite commit or release instead of installing from GitHub main. For medical, internal, or otherwise sensitive documents, confirm the gateway is local or trusted and know where the Chroma database is stored.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: scripts/install.sh:15

Finding

Mutable Git Branch Used for Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: scripts/install.sh, lines 15–16
Vulnerability Type: Unpinned dependency installed from a mutable remote source
Risk Level: High

Vulnerable Code

bash

# Install from GitHub main (or tag) so this skill works anywhere.
python -m pip install --upgrade "git+https://github.com/VirajSanghvi1/raglite.git@main"

Technical Analysis

The installation script retrieves and installs RAGLite directly from the mutable main branch of a remote GitHub repository. Because the dependency is not pinned to an immutable commit hash or a cryptographically verified release artifact, the code installed at any given time can differ from the code that was reviewed.

Python package installation can execute package build logic and install executable entry points. Consequently, compromise of the upstream repository, maintainer account, or release workflow could cause arbitrary attacker-controlled code to run during installation or when the installed raglite command is subsequently invoked.

The use of TLS protects the network connection but does not guarantee that the repository's current branch contents are the same contents that were audited.

Attack Path

1. An attacker compromises the upstream repository, a maintainer account, or another mechanism capable of changing its main branch.
2. The attacker adds malicious package build logic, runtime code, or an altered raglite entry point and pushes it to main.
3. A user runs scripts/install.sh.
4. pip retrieves the current attacker-controlled revision and processes the package.
5. Malicious code can execute during package installation or later when scripts/raglite.sh invokes the installed raglite executable.
6. The payload operates with the privileges of the user running the installation or skill.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the installing user's acco ...[truncated 531 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to a reviewed, immutable full commit hash rather than main, for example:

  bash

  python -m pip install \
    "git+https://github.com/VirajSanghvi1/raglite.git@<full-reviewed-commit-hash>"
  

• Prefer a versioned release artifact from a trusted package registry and require hashes with a locked requirements file:

  bash

  python -m pip install --require-hashes -r requirements.lock
  

• Record hashes for the complete transitive dependency set so indirect dependencies are also reproducible and integrity-checked.

• Review and update pinned versions through a controlled dependency-update process instead of resolving the latest branch contents during installation.

• Consider vendoring or internally mirroring the reviewed artifact where stronger supply-chain assurance is required.

• Run installation and the resulting tool as an unprivileged user with access limited to the documents and services required for the task.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 85% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

md

2) **Index** locally into Chroma
3) **Query** with hybrid retrieval (vector + keyword)

It doesn’t replace memory/context — it’s the place to store what you need again.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly encourages use with highly sensitive data such as medical records and internal documents, but it defaults to an engine that may send document content to a reachable OpenClaw gateway and may also interact with a Chroma server over HTTP. Without a clear warning about where data is transmitted and stored, users may unknowingly expose sensitive content to external services or networked endpoints.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The installer pulls and executes package code directly from a GitHub branch tip (@main) at install time, which makes builds non-reproducible and exposes users to supply-chain compromise if the repository, maintainer account, or transit path is abused. In a security-sensitive skill, claiming to be local-first does not mitigate the risk because the install step still requires remote code retrieval and execution.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The comment says installing from GitHub main or a tag makes the skill work anywhere, but the implementation requires external network access to GitHub and therefore will not work in offline or restricted environments. This is an intent-level contradiction between the documentation comment and the actual operational requirement.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.