# Hunt Rag Vector

Hunt vector-store / embedding-layer weaknesses in RAG pipelines (OWASP LLM08 Vector and...

- Repository: https://github.com/Zyrexnn/Cybermes (987 stars)
- Category: Security
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add Zyrexnn/Cybermes --skill hunt-rag-vector -g -a claude-code -y`
Codex: `npx skills add Zyrexnn/Cybermes --skill hunt-rag-vector -g -a codex -y`
Cursor: `npx skills add Zyrexnn/Cybermes --skill hunt-rag-vector -g -a cursor -y`
Gemini CLI: `npx skills add Zyrexnn/Cybermes --skill hunt-rag-vector -g -a gemini-cli -y`

## Description

Hunt vector-store / embedding-layer weaknesses in RAG pipelines (OWASP LLM08 Vector and Embedding Weaknesses), persistent corpus poisoning that survives across sessions and users (distinct from one-shot indirect prompt injection, which is owned by hunt-llm-ai), cross-tenant vector-database IDOR (unauthenticated or unscoped queries against Pinecone/Weaviate/Chroma/Milvus/Qdrant/pgvector), source-text/metadata leakage in similarity-search results, and retrieval-hijack via adversarial embedding proximity ('SEO poisoning' for RAG). Targets: any app with a shared knowledge base, document upload feeding a chatbot, or a directly reachable vector-DB port. Validate: a second, clean session/account must inherit a poisoned result, or a cross-tenant artifact must be independently verifiable, confabulation is not a finding, same bar as hunt-llm-ai. Use when target is RAG-backed, exposes a vector-DB port, or lets users upload documents that other users' queries later retrieve.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

## LLM08, Vector & Embedding Weaknesses (RAG Pipeline Attacks)

`hunt-llm-ai` already owns *session-scoped* indirect injection, a hidden instruction in one
document that fires when that specific document is summarized, and ASI06 memory poisoning
(a RAG-indexed document that reaches later users). This skill goes one level deeper: it owns
the vector **storage and retrieval layer itself**, attacks that don't need any prompt-injection
payload at all, because the bug lives in how the embeddings are stored, scoped, and searched.

Read `hunt-llm-ai`'s False-Positive Gate first, it applies here unchanged (run-twice rule,
anchor to a known secret, cross-tenant proof not assertion, OOB-or-it-didn't-happen for exfil).
This document adds gates specific to the vector layer.

---

## Attack Surface Signals

- Directly reachable vector-DB ports: Chroma `:8000`, Weaviate `:8080`, Qdrant `:6333`,
  Milvus `:19530`, Elasticsearch/OpenSearch with `dense_vector`/kNN mappings, managed pgvector
  via an exposed Postgres port.
- A "upload your documents, ask questions about them" feature shared across multiple users or
  tenants (support-ticket search, internal wiki chatbot, multi-tenant SaaS RAG product).
- API responses that include a "similar documents" or "sources" block, check whether it leaks
  the **raw chunk text** and **document ID** of items outside the querying user's own tenant.
- A debug/analytics/admin endpoint that returns raw embedding vectors (`[0.0123, -0.0456, ...]`)
  rather than just the retrieved text.

---

## Technique 1, Persistent Corpus Poisoning

The proof bar is stronger than `hunt-llm-ai`'s indirect injection: you must show the payload
survives ingestion and reaches a **different, clean session** via **semantic retrieval on an
unrelated query**, not just "the document I uploaded gets summarized when I open it again."

The rest: https://github.com/Zyrexnn/Cybermes/blob/HEAD/knowledge/Claude-BugHunter/skills/hunt-rag-vector/SKILL.md