RAGLite

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:49 AM UTC
• Version: 1.0.0

Overview

RAGLite is a coherent document retrieval skill, but it installs mutable remote code and may send sensitive document contents through an OpenClaw gateway by default.

Review the upstream raglite repository and pin it to a trusted commit before installing. Treat documents processed with the default OpenClaw engine as potentially sent to the configured gateway, and avoid running it on sensitive personal, medical, or internal documents unless that gateway and its logging/retention behavior are trusted.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: scripts/install.sh:15

Finding

Installation Executes an Unpinned Remote Dependency from a Mutable Branch

Content

View full analysis

Vulnerability Details

File Location: scripts/install.sh, lines 15–18
Vulnerability Type: Supply-chain exposure through an unpinned remote dependency
Risk Level: High

Vulnerable Code

bash

# Install from GitHub main (or tag) so this skill works anywhere.
python -m pip install --upgrade "git+https://github.com/VirajSanghvi1/raglite.git@main"

The installation process also upgrades build and packaging tools without version or integrity constraints:

bash

python -m pip install --upgrade pip setuptools wheel >/dev/null

Technical Analysis

The installer retrieves RAGLite directly from the mutable main branch of an external GitHub repository. It does not pin the dependency to a reviewed commit, verify an artifact hash or signature, or use a lockfile. The effective code installed and subsequently executed can therefore change after this skill has been reviewed.

Python package installation may execute package build hooks and related installation logic. Consequently, a malicious upstream revision could execute code during installation, even before the installed raglite command is invoked. The unconditional upgrade of pip, setuptools, and wheel similarly introduces unpinned package changes, although those packages are retrieved through pip's configured package source rather than the cited GitHub repository.

The remotely installed implementation is absent from this project, so its behavior cannot be established from the audited files. This finding identifies supply-chain exposure and does not assert that the current upstream repository is malicious.

Attack Path

1. An attacker compromises the upstream repository, its maintainer account, or another mechanism capable of modifying the main branch.
2. The attacker adds malicious package build logic or runtime code to that branch.
3. A user runs ./scripts/install.sh.
4. Pip retrieves the attacker-controlled revision without im ...[truncated 1019 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin RAGLite to a reviewed, immutable Git commit rather than main, for example:

   bash

   python -m pip install \
     "git+https://github.com/VirajSanghvi1/raglite.git@<reviewed-full-commit-sha>"
   

2. Prefer a signed, versioned release distributed as a wheel. Record and verify its SHA-256 digest using a locked requirements file and pip install --require-hashes.
3. Pin exact versions and hashes for pip, setuptools, wheel, and all transitive dependencies. Avoid unconditional upgrades during routine skill installation.
4. Audit the exact RAGLite revision, including packaging metadata, build backend, build hooks, dependency declarations, and runtime network behavior, before approving it.
5. Build dependencies in a controlled environment and publish reproducible, verified artifacts through a trusted registry or internal artifact repository.
6. Run installation and document processing as an unprivileged account with narrowly scoped filesystem and network access. Do not install this dependency with root or administrator privileges.
7. Add automated controls that reject mutable VCS references and dependency changes lacking integrity metadata or security review.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill is presented as a local-first document distillation and retrieval tool, but the installation path explicitly fetches and installs code from a GitHub repository at runtime. That creates additional supply-chain and remote-code-execution exposure not clearly conveyed by the primary description, which can mislead users about the trust boundary and operational risk.

Content

No source excerpt is available for this finding.

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 85% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

md

2) **Index** locally into Chroma
3) **Query** with hybrid retrieval (vector + keyword)

It doesn’t replace memory/context — it’s the place to store what you need again.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill handles potentially sensitive local/private documents and states that condensation may use OpenClaw via a reachable gateway, but it does not prominently warn that document contents may be sent to an external service. In this context, omission of that disclosure is dangerous because users may process medical, personal, or internal documents under the assumption that the workflow is fully local.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The installer pulls and installs code directly from a GitHub repository branch (@main), which is mutable and not integrity-pinned. This creates a supply-chain risk: if the repository, branch, or transit path is compromised, arbitrary code can execute during installation via package setup/build hooks, undermining the claim of a local-first skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.