Security audit

Corpus RAG & KG Search (IM identity)

Security checks across malware telemetry and agentic risk

Overview

This skill coherently provides internal document and knowledge-graph search, but it broadly encourages automatic internal lookup and sends full user queries with IM identity to a configured backend.

Install only in environments where the configured backend is trusted to receive full user questions and IM identity headers. Administrators should narrow the rag-search trigger policy, warn users that internal lookup sends their query to the backend, and avoid using it for prompts containing secrets or unrelated personal data.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The tool description instructs the agent to automatically query internal-document search whenever a question may relate to company materials, while also disclosing that backend identification uses requesterSenderId and IM headers. This creates a privacy and data-governance risk because user prompts may be sent to a backend service by default without explicit user awareness or a clear minimization rule, increasing the chance of unnecessary internal data access and metadata-linked query logging.

Vague Triggers

High

Confidence: 94% confidence
Finding: The skill metadata instructs the agent to automatically invoke RAG whenever a query might involve internal materials, without requiring clear user intent or necessity. This broad default can cause unnecessary transmission of user prompts into an internal retrieval system, increasing the chance of oversharing sensitive context and bypassing user expectations about when internal lookup occurs.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The invocation guidance uses ambiguous conditions such as questions that 'may' involve internal materials and says to search by default, leaving excessive discretion to the agent. Ambiguity in security-relevant routing can lead to over-invocation, inconsistent handling of sensitive queries, and accidental retrieval from internal corpora when a general answer would suffice.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill explicitly says to pass only the full userQuery to the RAG system but provides no warning that the user's entire question may be sent for internal document lookup. If users include secrets, personal data, or unnecessary business context in their prompt, that information could be propagated into logs, retrieval pipelines, or downstream systems without informed consent.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Content: const RAG_DESCRIPTION = "【语料库文档检索】查询公司内部文档、技术规范、操作手册、政策文件等原始文档内容的默认工具。只要用户问题可能与公司内部资料相关，就应默认先调用本工具补充信息再回答，不需要用户明确要求查资料才调用；仅当问题与内部资料完全无关（闲聊、通用常识等）时可跳过。成功时返回 JSON 顶层的 evidenceSummaryText（来源摘要）、sourceDocuments（各文件 fileName 与 segments 正文）。示例：'OMRON 安全控制器的技术参数'、'项目管理流程的详细说明'、'查找关于安全生产的手册'。仅传 userQuery；后端通过 requesterSenderId、im 请求头识别用户与渠道。"; export const RAG_TOOL_PRESET = { toolName: "rag-search", description: RAG_DESCRIPTION,
Confidence: 88% confidence
Finding: DESCRIPTION =; description:; eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZ2VuZXJhbFJhZ1NlYXJjaC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy90b29scy9nZW5lcmFsUmFnU2VhcmNoLnRzIl0sIm5hbWVzIjpbXSwibWFwcGl

VirusTotal

61/61 vendors flagged this plugin as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.