Rag Knowledge Assistant

• Outcome: Review
• Latest audit: Jun 28, 2026 · 4:43 PM UTC
• Version: 2.0.1

Overview

The skill appears to be a real local RAG assistant, but it exposes indexed private documents through an unauthenticated API bound to all network interfaces and relies on risky dependency and index-loading patterns.

Install only if you are comfortable indexing the selected local documents. Run the API bound to 127.0.0.1 unless you intentionally want network access, avoid putting secrets or highly sensitive files in the knowledge directory, upgrade and lock dependencies before production use, and treat vector stores and BM25 pickle indexes as sensitive local data.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill advertises and instructs use of shell commands, local file access, networked API calls, and writing logs/vector stores, yet declares no permissions. This creates a trust and policy gap: an agent or operator may invoke capabilities with broader access than expected, increasing the chance of unintended file modification, data exposure, or network access without explicit review.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 83% confidence
• Finding: The documented purpose is a local RAG assistant, but the broader behavior includes undeclared model downloads/loading and HTTP calls to a local Ollama service, plus unrelated PDF-to-PNG processing. Description-behavior mismatch is dangerous because reviewers may approve the skill for a narrow local-use case while it actually performs additional networked and data-processing actions that can expose sensitive documents, pull unpinned code/models at runtime, or expand attack surface beyond what users expect.

Context-Inappropriate Capability

Low

• Confidence: 91% confidence
• Finding: The /stats endpoint discloses the local vector store directory path taken from the VECTORSTORE_DIR environment variable. While this is not directly exploitable on its own, it leaks internal filesystem layout and deployment details that can aid reconnaissance and help an attacker tailor follow-on attacks against the host or adjacent services. In a RAG query API, exposing backend storage paths is unnecessary for normal client functionality.

Known Vulnerable Dependency: langchain==0.1.0 — 7 advisory(ies): CVE-2026-45134 (LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust); CVE-2024-2965 (Denial of service in langchain-community); CVE-2024-8309 (Langchain SQL Injection vulnerability) +4 more

Critical

• Category: Supply Chain
• Confidence: 98% confidence
• Finding: The requirements file explicitly permits langchain 0.1.0, a version with multiple serious advisories including SQL injection and unsafe deserialization-related issues. In a RAG assistant, LangChain often brokers retrieval, tool use, prompt loading, and data access, so vulnerable versions can expose the service to remote compromise, SSRF-like behaviors, or denial of service when handling untrusted inputs.

Known Vulnerable Dependency: langchain-community==0.0.10 — 7 advisory(ies): CVE-2024-2965 (Denial of service in langchain-community); CVE-2024-5998 (LangChain pickle deserialization of untrusted data); CVE-2025-2828 (LangChain Community SSRF vulnerability exists in RequestsToolkit component ) +4 more

Critical

• Category: Supply Chain
• Confidence: 99% confidence
• Finding: langchain-community 0.0.10 is flagged with multiple high-severity issues including pickle deserialization and SSRF-related weaknesses. This is particularly dangerous in a local RAG knowledge system because community integrations often interact with external URLs, loaders, and toolkits that process attacker-influenced content or endpoints.

Known Vulnerable Dependency: langchain-text-splitters==0.0.1 — 3 advisory(ies): CVE-2026-41481 (LangChain Text Splitters: HTMLHeaderTextSplitter.split_text_from_url SSRF Redire); CVE-2025-6985 (LangChain Text Splitters is vulnerable to XML External Entity (XXE) attacks due ); CVE-2026-41481 (LangChain is a framework for building agents and LLM-powered applications. Prior)

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: langchain-text-splitters 0.0.1 has advisories including SSRF and XXE-like parsing risks. In a RAG stack, text splitters may process remote or structured content during ingestion, so flaws here can allow attacker-controlled documents or URLs to trigger internal network access, parser abuse, or denial-of-service conditions.

Known Vulnerable Dependency: transformers==4.40.0 — 10 advisory(ies): CVE-2025-3933 (Transformers is vulnerable to ReDoS attack through its DonutProcessor class); CVE-2025-6921 (Hugging Face Transformers vulnerable to Regular Expression Denial of Service (Re); CVE-2025-6638 (Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer) +7 more

High

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: transformers 4.40.0 is reported with multiple ReDoS and parser-related vulnerabilities. In this skill, transformer models are part of embedding or NLP processing, so maliciously crafted text inputs or model-processing paths could degrade service availability or trigger excessive resource consumption.

Known Vulnerable Dependency: torch==2.0.0 — 10 advisory(ies): CVE-2025-2953 (PyTorch susceptible to local Denial of Service); CVE-2025-32434 (PyTorch: `torch.load` with `weights_only=True` leads to remote code execution); CVE-2024-31580 (PyTorch heap buffer overflow vulnerability) +7 more

Critical

• Category: Supply Chain
• Confidence: 98% confidence
• Finding: torch 2.0.0 carries multiple serious advisories, including unsafe model loading scenarios and memory-safety issues. In an ML-backed RAG system, PyTorch is a high-risk component because model files, checkpoints, or serialized weights may be loaded during setup or runtime, creating potential for remote code execution, crashes, or denial of service if untrusted artifacts are introduced.

Known Vulnerable Dependency: pypdf==3.0.0 — 10 advisory(ies): CVE-2026-48156 (pypdf: Possible long runtimes for zero-only width values in cross-reference stre); CVE-2026-24688 (pypdf has possible Infinite Loop when processing outlines/bookmarks); CVE-2026-27628 (pypdf has a possible infinite loop when loading circular /Prev entries in cross-) +7 more

Low

• Category: Supply Chain
• Confidence: 86% confidence
• Finding: pypdf 3.0.0 is associated mainly with parser robustness issues such as long runtimes and infinite loops. In a document-ingesting RAG service, this can still matter because attacker-supplied PDFs could tie up workers or cause ingestion failures, but the listed impact appears more availability-oriented than compromise-oriented.

Known Vulnerable Dependency: unstructured==0.10.0 — 2 advisory(ies): CVE-2024-46455 (unstructured XML External Entity (XXE)); CVE-2025-64712 (Unstructured has Path Traversal via Malicious MSG Attachment that Allows Arbitra)

Critical

• Category: Supply Chain
• Confidence: 99% confidence
• Finding: unstructured 0.10.0 is reported vulnerable to XXE and path traversal via malicious attachments, which is highly relevant for a RAG knowledge assistant that ingests user-provided files. Because this component parses complex documents, a crafted file could potentially read local files, access internal resources, or write/extract content outside intended paths.

Known Vulnerable Dependency: pydantic==2.0.0 — 1 advisory(ies): CVE-2024-3772 (Pydantic regular expression denial of service)

Low

• Category: Supply Chain
• Confidence: 87% confidence
• Finding: pydantic 2.0.0 has a known regular-expression DoS issue. Since FastAPI commonly uses Pydantic for request validation, crafted inputs could consume excessive CPU during validation, impacting availability of the API service.

Known Vulnerable Dependency: requests==2.31.0 — 3 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func)

Low

• Category: Supply Chain
• Confidence: 89% confidence
• Finding: requests 2.31.0 includes advisories such as credential leakage via malicious URLs and request verification issues in some session flows. In a RAG system that may fetch remote resources or interact with APIs, misuse of this version could expose credentials or weaken transport assurances, though impact depends on actual request patterns.

Static analysis

No suspicious patterns detected.