library-rag

SUSPICIOUS. The core capability matches the stated RAG purpose and uses mostly official tooling, but the skill forwards private corpus content and credentials to remote embedding providers, with an optional third-party OpenRouter fallback that weakens data-flow integrity. Main concerns are remote data exposure, local secret handling, and unpinned dependency installation rather than overtly malicious behavior.

This module primarily acts as an embeddings client (HTTPS requests with a Bearer API key) and includes deterministic vector utilities. There is no clear evidence of embedded malware/backdoors in the snippet. The main security concern is the sensitive pattern of enabling and loading a native SQLite extension via sqlite_vec.load(conn), which elevates supply-chain/code-execution risk depending on sqlite_vec provenance and loaded artifacts. A minor additional issue is a likely bug in connect_db() returning an undefined variable (`con`). Overall: low likelihood of intentional malicious logic in this code, with moderate-to-high security risk driven by native extension loading and external API credential/data handling.

No explicit malicious code (e.g., eval/exec, reverse shells, hardcoded secrets, or obvious exfiltration endpoints) is present in this fragment. The main security concern is operational: the 'add_book' tool takes an externally supplied file_path and passes it to conversion/indexing routines without validation/allowlisting, which could enable unintended local file access/conversion and database/file-system modification if the server is reachable by untrusted callers. External network access is likely via get_embedding/load_api_key, but the destination/exfiltration behavior is not visible here. Overall, this looks more like a RAG service with a potentially risky ingestion surface than a clearly malicious package, but additional review of the imported modules and deployment exposure is recommended.