Individual skill
hunt-rag-vector
Hunt vector-store / embedding-layer weaknesses in RAG pipelines (OWASP LLM08 Vector and Embedding Weaknesses) — persistent corpus poisoning that survives across sessions and users (distinct from one-shot indirect prompt injection, which is owned by hunt-llm-ai), cross-tenant vector-database IDOR (unauthenticated or unscoped queries against Pinecone/Weaviate/Chroma/Milvus/Qdrant/pgvector), source-text/metadata leakage in similarity-search results, and retrieval-hijack via adversarial embedding proximity ('SEO poisoning' for RAG). Targets: any app with a shared knowledge base, document upload feeding a chatbot, or a directly reachable vector-DB port. Validate: a second, clean session/account must inherit a poisoned result, or a cross-tenant artifact must be independently verifiable — confabulation is not a finding, same bar as hunt-llm-ai. Use when target is RAG-backed, exposes a vector-DB port, or lets users upload documents that other users' queries later retrieve.
skills/hunt-rag-vector/SKILL.md
Source commit 961a0dd3d2d2f66a07a416ade3b1d4473b64802e
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- No
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Not checked yet
- Last checked
- Nov 4, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 1,008
- Repository last updated
- Nov 5, 2026
- License
- Apache-2.0
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- ai-agent Repository topic
- appsec Repository topic
- bug-bounty Repository topic
- cybersecurity Repository topic
- devsecops Repository topic
- exploit-validation Repository topic
- hermes-agent Repository topic
- infosec Repository topic
- llm-security Repository topic
- nuclei Repository topic
- marketing Derived category
- data Derived category
- security Derived category
- data-databases Derived category
- security-application Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Read excerpt
## LLM08 — Vector & Embedding Weaknesses (RAG Pipeline Attacks)
`hunt-llm-ai` already owns *session-scoped* indirect injection — a hidden instruction in one
document that fires when that specific document is summarized, and ASI06 memory poisoning
(a RAG-indexed document that reaches later users). This skill goes one level deeper: it owns
the vector **storage and retrieval layer itself** — attacks that don't need any prompt-injection
payload at all, because the bug lives in how the embeddings are stored, scoped, and searched.
Read `hunt-llm-ai`'s False-Positive Gate first — it applies here unchanged (run-twice rule,
anchor to a known secret, cross-tenant proof not assertion, OOB-or-it-didn't-happen for exfil).
This document adds gates specific to the vector layer.
---
