open-ragflow

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The domain https://hf-mirror.com is an unofficial Hugging Face mirror referenced as HF_ENDPOINT in multiple files; using an untrusted mirror to fetch model weights or artifacts can deliver arbitrary/malicious content and is therefore potentially risky.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). RAGFlow’s required runtime workflow ingests outsider-authored free text via its Flask REST/dialog chat entry points and can also ingest user-uploaded document text into the RAG/agent retrieval pipeline.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The docs contain installation commands that clone and run remote code (git clone https://github.com/infiniflow/ragflow.git) and pull/run Docker images (e.g., infiniflow/ragflow and the China mirror registries) which will fetch and execute external code during setup.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill includes explicit instructions that require elevated privileges and modification of system files (e.g., "sudo sysctl -w vm.max_map_count=262144" and adding entries to /etc/hosts), which push the agent to change the host machine state.