skills.rest
inventashif
inventashifCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunt-rag-vector

Detect vector-store and embedding-layer weaknesses in RAG pipelines during security assessments.

Updated Sep 6, 2026
Search Tags:#security testing#rag#vector database#embedding#idor#corpus poisoning#owasp llm08
One-click install
npx skills add https://github.com/inventashif/helpful-code-sidekick --skill hunt-rag-vector-inventashif
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-rag-vector
Source: https://github.com/inventashif/helpful-code-sidekick/tree/main/scripts/hackerai/skills/bughunter/hunt-rag-vector
Command: npx skills add https://github.com/inventashif/helpful-code-sidekick --skill hunt-rag-vector-inventashif

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security testers assessing RAG-backed applications often miss vulnerabilities in the vector storage and retrieval layer, such as cross-tenant data exposure, unauthenticated vector-DB APIs, and persistent corpus poisoning that survives across sessions. ## Core Features & Use Cases - Persistent Corpus Poisoning Testing: Upload a document with a hidden instruction and verify from a second clean session whether the payload is retrieved and executed on unrelated queries. - Cross-Tenant Vector-Store IDOR Checks: Probe directly reachable Chroma, Qdrant, Weaviate, Milvus, or pgvector endpoints and test app-level namespace or document-ID parameters for tenant isolation failures. - Source-Text and Metadata Leakage Detection: Inspect similarity-search and sources endpoints for raw chunk text or document IDs belonging to other tenants, and distinguish this from true embedding inversion. - Use Case: While testing a multi-tenant SaaS chatbot with document upload, you discover its Qdrant port is exposed, list all collections without credentials, and report an unauthenticated full corpus read as a Critical finding. ## Quick Start Use the hunt-rag-vector skill to test this RAG-based chat application for vector-store isolation flaws and persistent corpus poisoning.

Frequently Asked Questions about hunt-rag-vector

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test a RAG application for vector database vulnerabilities?▼

Test a RAG application by probing exposed vector-DB ports (Chroma 8000, Qdrant 6333, Weaviate 8080, Milvus 19530) for unauthenticated access, manipulating namespace or document-ID parameters in the app API, and checking similarity-search responses for cross-tenant chunk text leakage.

How to verify persistent corpus poisoning in a RAG pipeline?▼

Verify persistent corpus poisoning by uploading a document with a hidden instruction, waiting for ingestion, then querying from a second clean session or account about an unrelated common topic. The finding is valid only if the payload fires in that separate session via normal semantic retrieval.

What is cross-tenant IDOR in vector databases?▼

Cross-tenant vector-store IDOR occurs when tenant isolation is enforced in the application layer but not in the vector database itself. Attackers reach the DB directly or supply a namespace or document ID parameter to retrieve another tenant's content, proven with an independently verifiable artifact.

Can attackers recover source text from embedding vectors?▼

True embedding inversion requires an attacker-trained decoder model and is rarely practical. The common real-world finding is source-text leakage through metadata: RAG systems store original chunk text alongside vectors, so any similarity or sources endpoint exposing it leaks the raw text directly.

What severity is an unauthenticated vector database API?▼

An unauthenticated vector-DB API returning real document content is rated Critical on its own, with no chaining required. Verified cross-tenant retrieval and second-session persistent poisoning rate High to Critical, while retrieval hijack without a chain is Medium at best.

Related Skills

Explore More Software Engineering Skills→
just-cameronjust-cameron
23

using-xrpc-indexer

Queries cognition records via comind's network.search API with vector similarity across concepts, thoughts, memories, hypotheses.

Community
Intermediate
Wyl-cmdWyl-cmd
6

report-writing

Writes impact-first bug bounty reports for HackerOne, Bugcrowd, Intigriti, and Immunefi.

Community
Intermediate
hoanghn61hoanghn61

ai-threat-testing

Test LLM applications for OWASP LLM Top 10 vulnerabilities.

Community
Advanced
kontext-devkontext-dev

kontext-mcp

Explain Kontext integration with MCP for agent authentication and credential management.

Official
Intermediate