skills.rest
marcboggs
marcboggsCOMMUNITY
Explore all skills by this author →
GitHub

hunt-rag-vector

Tests RAG pipelines and vector databases for corpus poisoning, cross-tenant IDOR, and embedding-layer leakage.

1|Updated Aug 21, 2026
Search Tags:#penetration testing#rag#vector database#idor#llm security#corpus poisoning#owasp llm08
One-click install
npx skills add https://github.com/marcboggs/BMAD-AppSec-Orchestrator --skill hunt-rag-vector-marcboggs
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-rag-vector
Source: https://github.com/marcboggs/BMAD-AppSec-Orchestrator/tree/main/.claude/skills/hunt-rag-vector
Command: npx skills add https://github.com/marcboggs/BMAD-AppSec-Orchestrator --skill hunt-rag-vector-marcboggs

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security testers assessing RAG-backed applications lack structured guidance for attacking the vector storage and retrieval layer itself, as opposed to session-scoped prompt injection, and often report unverifiable findings like confabulated model outputs or same-session re-asks. ## Core Features & Use Cases - Persistent Corpus Poisoning Tests: Uploads poisoned documents and verifies the payload reaches a second, clean session via semantic retrieval on unrelated queries. - Cross-Tenant Vector-Store IDOR: Probes directly reachable vector databases (Chroma, Weaviate, Qdrant, Milvus, pgvector) and app-level namespace parameters for unauthenticated or unscoped corpus access. - Source-Text and Metadata Leakage Detection: Checks similarity-search and sources endpoints for raw chunk text belonging to other tenants, distinguishing it from true embedding inversion. - Use Case: While assessing a multi-tenant SaaS chatbot with document upload, you discover an exposed Qdrant port on :6333, list all collections without credentials, and prove unauthenticated full corpus read as a Critical finding. ## Quick Start Ask the agent to test the target application's RAG pipeline for vector-store weaknesses, starting with reachable vector-DB ports and cross-tenant retrieval checks.

Frequently Asked Questions about hunt-rag-vector

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test a RAG application for vector database vulnerabilities?▼

Start by checking for directly reachable vector-DB ports (Chroma :8000, Qdrant :6333, Weaviate :8080, Milvus :19530) and probe them unauthenticated. Then test the app's query API for attacker-controlled namespace or document-ID parameters, and check similarity-search responses for cross-tenant chunk text.

What is the difference between RAG corpus poisoning and indirect prompt injection?▼

Indirect prompt injection is session-scoped: a hidden instruction fires when a specific document is summarized. Corpus poisoning persists in the vector store and must be proven to reach a second, clean session via semantic retrieval on an unrelated query, which is the higher proof bar this skill enforces.

How do I prove cross-tenant data leakage in a vector store?▼

Retrieve content containing a value you can independently verify belongs to a different real tenant or account, and compare it against a control query on your own account. Different-looking content alone does not meet the proof standard.

Can attackers recover source text from embedding vectors?▼

True embedding inversion requires an attacker-trained decoder model and is rarely practical. The common real-world finding is source-text leakage through metadata stored alongside vectors and exposed via similarity-search or sources endpoints, which needs no ML at all.

Why are RAG poisoning findings rejected as false positives?▼

Rejections usually happen when the payload only reproduces in the uploading session, when no OOB callback or independent artifact verifies impact, or when model confabulation is reported as a finding. A second clean session must inherit the poisoned result through normal query flow.

Related Skills

Explore More Software Engineering Skills→
elementalsoulselementalsouls
4.0k

hunt-rag-vector

Detect vector-store and embedding-layer weaknesses in RAG pipelines during authorized security testing.

Community
Advanced
OdradekAIOdradekAI
5

opi-remediate

Verify audit findings against code and generate layered remediation plans.

Official
Advanced
hoanghn61hoanghn61

ai-threat-testing

Test LLM applications for OWASP LLM Top 10 vulnerabilities.

Community
Advanced
slysikslysik

databricks-vector-search

Manage Databricks Vector Search endpoints and indexes for RAG applications.

Community
Advanced