skills.rest
elementalsouls
elementalsoulsCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunt-rag-vector

Detect vector-store and embedding-layer weaknesses in RAG pipelines during authorized security testing.

4.0k|628|Updated May 5, 2026
Search Tags:#penetration testing#vector database#embedding#llm security#rAG#idOR#corpus poisoning
One-click install
npx skills add https://github.com/elementalsouls/Claude-BugHunter --skill hunt-rag-vector
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-rag-vector
Source: https://github.com/elementalsouls/Claude-BugHunter/tree/main/skills/hunt-rag-vector
Command: npx skills add https://github.com/elementalsouls/Claude-BugHunter --skill hunt-rag-vector

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security testers assessing RAG-backed applications lack a structured methodology for finding vulnerabilities in the vector storage and retrieval layer, such as cross-tenant data leaks, unauthenticated vector databases, and persistent corpus poisoning that survives across sessions.

Core Features & Use Cases

  • Persistent Corpus Poisoning Testing: Upload poisoned documents and verify the payload reaches a second, clean session via semantic retrieval on unrelated queries.
  • Cross-Tenant Vector-Store IDOR Detection: Probe directly reachable vector databases (Chroma, Qdrant, Weaviate, Milvus, pgvector) and app APIs for missing tenant isolation, with a verifiable-artifact proof standard.
  • Source-Text and Metadata Leakage Checks: Inspect similarity-search and sources endpoints for raw chunk text exposure, and distinguish metadata leaks from true embedding inversion.
  • Use Case: While testing a multi-tenant SaaS chatbot with document upload, use this Skill to check whether an unauthenticated Qdrant port exposes the full corpus and whether another tenant's documents appear in your similarity results.

Quick Start

Ask the assistant to assess the target RAG application for vector-store isolation weaknesses, exposed vector-DB ports, and persistent corpus poisoning using the hunt-rag-vector methodology.

Frequently Asked Questions about hunt-rag-vector

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test a RAG application for vector database vulnerabilities?▼

Probe for directly reachable vector-DB ports (Chroma :8000, Qdrant :6333, Weaviate :8080, Milvus :19530), test whether the app API accepts attacker-controlled namespace or document IDs, and check similarity-search responses for cross-tenant chunk text. Verify any cross-tenant finding against a same-account control query.

What is persistent corpus poisoning in RAG pipelines?▼

Persistent corpus poisoning is uploading a document with a hidden instruction that gets indexed and later retrieved by other users' unrelated queries. Valid proof requires a second, clean session or account triggering the payload through normal semantic retrieval, not the uploader re-asking about their own document.

How is vector-store IDOR different from regular IDOR?▼

Vector-store IDOR occurs when tenant isolation is enforced in the application layer but not in the vector database itself, allowing unauthenticated corpus reads or cross-tenant retrieval via manipulated namespace parameters. The proof standard is the same: an independently verifiable artifact belonging to a different tenant.

Can attackers recover source text from embedding vectors?▼

True embedding inversion requires an attacker-trained decoder model and direct query access to the embedding model, making it research-grade in most cases. The practical finding is source-text leakage through metadata stored alongside vectors and exposed via similarity-search or sources endpoints.

What severity is an unauthenticated vector database exposure?▼

An unauthenticated vector-DB API returning real document content is rated Critical on its own, with no chaining required. Verified cross-tenant retrieval and second-session persistent poisoning rate High to Critical, while retrieval hijack without a chain is Medium at best.

Related Skills

Explore More Software Engineering Skills→
ovachieverovachiever
52

cloudflare-vectorize

Index and query vector embeddings with metadata filtering in Cloudflare Vectorize.

Community
Advanced
elementalsoulselementalsouls
3.3k

bugcrowd-reporting

Map Bugcrowd submissions to VRT categories and triage workflows.

Community
Advanced
latestaiagentslatestaiagents
5

prompt-injection-guard

Validate and sanitize user inputs to defend against prompt injection attacks.

Official
Advanced
Q16GQ16G
83

unauthorized-access

Verify protected endpoints enforce authentication for unauthenticated users.

Community
Advanced