ruvector
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill documentation provides various CLI commands executed via
npxto interact with the RuVector database, including operations for database creation, record insertion, similarity searching, and performance benchmarking.- [EXTERNAL_DOWNLOADS]: Executing commands likenpx ruvector@latestinvolves downloading theruvectorpackage from the official NPM registry at runtime. This is the standard delivery mechanism for the tool's functionality.- [PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it processes externally-provided vector data and metadata. - Ingestion points: Data is ingested through bulk file imports (
--file) and single vector insertions (--vector). Search results returned from the database also enter the agent's context. - Boundary markers: There are no explicit instructions or delimiters defined in the documentation to isolate retrieved database content from the agent's system instructions.
- Capability inventory: The skill has the capability to write to the local file system for persistent storage and to start a network-accessible HTTP or gRPC server.
- Sanitization: The provided documentation does not describe any specific sanitization or validation protocols for the data being stored or retrieved.
Audit Metadata