ClawHub
Back to skill

Security audit

RAGLite

Security checks across malware telemetry and agentic risk

Overview

RAGLite appears to be a coherent RAG tool, but it should be reviewed carefully because it installs mutable remote runtime code and may process sensitive documents through configured services.

Before installing, review the upstream GitHub repository and prefer a pinned commit or release if available. Use this only on folders you are comfortable turning into a durable searchable cache, and confirm that your OpenClaw gateway and Chroma endpoint are local or otherwise approved before processing sensitive records or internal documents.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding
The skill advertises a local-first RAG workflow, but the install instructions explicitly fetch and install code from a live GitHub repository and the default condensation path depends on an external OpenClaw gateway. That creates a meaningful trust and supply-chain gap: users may believe behavior is fully local and bounded by this skill, while actual execution and data handling are delegated to remote or separately hosted components not described in equivalent detail.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The installer pulls and executes code directly from a remote GitHub repository at install time, which makes the skill non-local-first in practice and introduces a supply-chain risk. Because it targets the mutable `main` branch rather than a pinned version or verified artifact, future upstream changes or repository compromise could silently alter what gets installed and executed.

Context-Inappropriate Capability

Low
Confidence
89% confidence
Finding
This script gives the installer network reachability to fetch and install executable Python package code from a remote repository, which expands the skill's trust boundary beyond the local environment. Even if the current repository is legitimate, installation-time execution of unpinned remote content can be abused through upstream compromise, branch drift, or dependency-chain attacks.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill encourages use with sensitive materials such as medical records and internal documents, but does not clearly warn that document contents may be transmitted to external or network services during condensation and indexing. This can mislead users into exposing private data to a gateway or remote Chroma instance under the assumption that processing is entirely local.

VirusTotal

52/52 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.