Hunt Rag Vector
Hunt vector-store / embedding-layer weaknesses in RAG pipelines (OWASP LLM08 Vector and...
Install
npx skills add Zyrexnn/Cybermes --skill hunt-rag-vector -g -a claude-code -y- Repository
- Zyrexnn/Cybermes987
- Category
- Security
- Updated
- 3d ago
- License
- Apache-2.0
- Context cost
- Mediumabout 2,280 tokens
- Runs scripts
- No, instructions only
What it does
Hunt vector-store / embedding-layer weaknesses in RAG pipelines (OWASP LLM08 Vector and Embedding Weaknesses), persistent corpus poisoning that survives across sessions and users (distinct from one-shot indirect prompt injection, which is owned by hunt-llm-ai), cross-tenant vector-database IDOR (unauthenticated or unscoped queries against Pinecone/Weaviate/Chroma/Milvus/Qdrant/pgvector), source-text/metadata leakage in similarity-search results, and retrieval-hijack via adversarial embedding proximity ('SEO poisoning' for RAG). Targets: any app with a shared knowledge base, document upload feeding a chatbot, or a directly reachable vector-DB port. Validate: a second, clean session/account must inherit a poisoned result, or a cross-tenant artifact must be independently verifiable, confabulation is not a finding, same bar as hunt-llm-ai. Use when target is RAG-backed, exposes a vector-DB port, or lets users upload documents that other users' queries later retrieve.
LLM08, Vector & Embedding Weaknesses (RAG Pipeline Attacks)
hunt-llm-ai already owns session-scoped indirect injection, a hidden instruction in one
document that fires when that specific document is summarized, and ASI06 memory poisoning
(a RAG-indexed document that reaches later users). This skill goes one level deeper: it owns
the vector storage and retrieval layer itself, attacks that don't need any prompt-injection
payload at all, because the bug lives in how the embeddings are stored, scoped, and searched.
Read hunt-llm-ai's False-Positive Gate first, it applies here unchanged (run-twice rule,
anchor to a known secret, cross-tenant proof not assertion, OOB-or-it-didn't-happen for exfil).
This document adds gates specific to the vector layer.
Attack Surface Signals
- Directly reachable vector-DB ports: Chroma
:8000, Weaviate:8080, Qdrant:6333, Milvus:19530, Elasticsearch/OpenSearch withdense_vector/kNN mappings, managed pgvector via an exposed Postgres port. - A "upload your documents, ask questions about them" feature shared across multiple users or tenants (support-ticket search, internal wiki chatbot, multi-tenant SaaS RAG product).
- API responses that include a "similar documents" or "sources" block, check whether it leaks the raw chunk text and document ID of items outside the querying user's own tenant.
- A debug/analytics/admin endpoint that returns raw embedding vectors (
[0.0123, -0.0456, ...]) rather than just the retrieved text.
Technique 1, Persistent Corpus Poisoning
The proof bar is stronger than hunt-llm-ai's indirect injection: you must show the payload
survives ingestion and reaches a different, clean session via semantic retrieval on an
unrelated query, not just "the document I uploaded gets summarized when I open it again."
