hunt-rag-vector
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill contains instructional content and methodology for security researchers to audit RAG-based applications for OWASP LLM08 vulnerabilities.
- [COMMAND_EXECUTION]: Provides example
curlcommands for probing vector database APIs (Chroma, Qdrant, Weaviate). These commands are designed for diagnostic purposes against a user-defined$TARGETand do not involve unauthorized local command execution or shell piping. - [PROMPT_INJECTION]: Includes sample prompt injection payloads used specifically to test for persistent poisoning in knowledge bases. These are illustrative examples for security testing and do not attempt to manipulate the agent's own behavior or safety filters.
- [INDIRECT_PROMPT_INJECTION]: Documents attack surfaces where untrusted data (uploaded documents) could influence RAG retrieval. The skill provides a structured framework for validating these risks using a "second-session rule" and verifiable artifacts.
Audit Metadata