Security audit

Llamaindex

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent LlamaIndex/RAG helper skill with ordinary examples for installing packages, loading documents, and using a local vector store, but users should avoid indexing sensitive data casually.

Before using the examples, install dependencies in an isolated environment, pin reviewed package versions for production, and only load documents or webpages you are allowed to index because vector stores may retain document-derived content on disk.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:29
Finding: Unpinned Third-Party Dependencies Create Supply-Chain Risk
Content: View full analysis
Remediation: View remediation
llama-index-llms-openai== llama-index-embeddings-openai== llama-index-vector-stores-chroma== ``` 2. Generate and commit a lock file that captures transitive dependencies. 3. Require cryptographic hashes for downloaded artifacts, such as by using a hash-locked requirements file with `pip install --require-hashes`. 4. Install only from the official Python Package Index or an authenticated internal package mirror; explicitly configure trusted indexes rather than relying on ambient pip configuration. 5. Review dependency provenance and release signatures where available. 6. Scan direct and transitive dependencies for known vulnerabilities before upgrades. 7. Test and approve dependency updates in an isolated environment before deployment. 8. Run installation and application processes under dedicated, least-privileged accounts without unnecessary access to secrets or sensitive documents. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The description and instructional content consistently force Chinese-language interaction, and there is no opt-in, alternative language option, or justification that the skill is region-specific. This can violate language/locale policy when users are not given a choice.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: This markdown file includes examples that read documents from a local directory, fetch web content, and persist embeddings/index data to a local Chroma database. The skill description does not warn users that using these examples may ingest sensitive files or create stored copies of document-derived data on disk.
Content: No source excerpt is available for this finding.