Security audit

ragflow-runbook

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed RAGFlow operations runbook whose Docker, API-checking, and optional alerting behavior matches its stated purpose.

Install only if you want an agent to help operate a RAGFlow deployment. Review the upstream Docker files before starting containers, pin a trusted RAGFlow version for production, keep API keys in environment variables or a secret manager, and enable cron/launchd or Telegram alerts only deliberately.

SkillSpector

By NVIDIA

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill explicitly requires environment variables, makes outbound network calls, and instructs execution of shell commands, yet it declares no corresponding permissions or capability constraints. This weakens governance and informed consent for agents/users, making it easier for the skill to perform impactful operations without clear policy review.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The stated purpose is a runtime-operations runbook, but the content also directs cloning software from GitHub and sending outbound alerts through OpenClaw/Telegram. This broader behavior increases supply-chain and data-egress risk because users may trust the skill as local ops guidance while it authorizes external fetches and messaging flows.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.