rag-security
Audits RAG pipelines for security flaws like prompt injection and uncontrolled document ingestion. Ensures retrieved content is properly gated before entering the LLM context.
Install
mkdir -p .claude/skills/rag-security && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/14709" && unzip -o skill.zip -d .claude/skills/rag-security && rm skill.zipInstalls to .claude/skills/rag-security
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Detects RAG pipelines that ingest external documents into LLM context withoutKey capabilities
- →Detect prompt injection vulnerabilities in RAG pipelines
- →Identify SSRF surfaces from caller-supplied URLs
- →Check for missing length or token caps on retrieved content
- →Verify explicit delimiters for untrusted retrieved content
- →Ensure retrieval sources are validated against a domain allowlist
- →Confirm every retrieval is logged with source URL and content length
How it works
The skill analyzes RAG pipeline implementations for patterns that could lead to prompt injection or SSRF by checking document ingestion, URL fetching, content length, and data framing.
Inputs & outputs
When to use rag-security
- →Reviewing document ingestion logic for RAG pipelines
- →Auditing HTTP fetch calls used to retrieve external source data
- →Validating trust gating implementations for LLM context
- →Identifying missing token or length caps on retrieved content
About this skill
RAG Pipeline Security (OWASP LLM01:2025)
What this checks
Prevents prompt injection through retrieved documents and uncontrolled content flooding into LLM context. Attacker-controlled documents can override system instructions, exfiltrate data, or manipulate model behavior when injected without guardrails.
Vulnerable patterns
- Retrieved document concatenated into the system prompt — retrieved content can override developer instructions.
- HTTP fetch of a caller-supplied or document-supplied URL with no domain allowlist — SSRF surface and attacker-controlled content into context.
- No length or token cap on retrieved content, allowing one document to consume the entire context window.
- Retrieved content mixed into the prompt with no delimiter or trust label distinguishing it from developer instructions.
Fix immediately
Flag the vulnerable code and explain the risk. Then suggest a fix that establishes these properties. Translate each property into the audited file's language, HTTP client, and LLM API — use the documented secure primitives of that stack.
- Retrieval sources are validated against a domain allowlist before fetch.
Arbitrary URLs from user input or from another document's links lead to SSRF
and to attacker-controlled documents landing in the context; the allowlist
is the same property enforced by the
ssrfskill for outbound HTTP. - Retrieved content is truncated to a fixed character or token cap before injection into the prompt. Unbounded retrieval lets a single document eat the context window — either denial of service or a vehicle for flooding instructions.
- Retrieved content is wrapped in explicit delimiters that label it as
untrusted data, and lives in the user role — never concatenated into the
system prompt. The model is more likely to treat it as data rather than
instructions when the framing is structural. See the
prompt-injectionskill for the trust-tier pattern. - Every retrieval is logged with source URL and content length — useful for incident response and for detecting poisoning attempts (sudden spikes in retrieved size or novel sources).
Verification
Confirm the response:
- Retrieved URLs validated against an explicit domain allowlist
- Content truncated to a fixed character or token limit before injection
- Retrieved content wrapped in clear delimiters that mark it as untrusted
- Every retrieval logged with source URL and content length
References
When not to use it
- →When the pipeline does not ingest external documents into LLM context
- →When the system does not retrieve content from external sources
- →When the focus is on general application security unrelated to RAG
Limitations
- →Applies only to RAG pipelines that ingest external documents
- →Focuses on prompt injection and uncontrolled content flooding
- →Does not cover general application security vulnerabilities
How it compares
This skill focuses specifically on security vulnerabilities unique to RAG pipelines, such as prompt injection via retrieved documents and uncontrolled content flooding, which generic security scanners might miss.
Compared to similar skills
rag-security side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| rag-security (this skill) | 0 | 2mo | No flags | Intermediate |
| engineering-advanced-skills | 3 | 2mo | Review | Advanced |
| agent-security-manager | 3 | 6mo | No flags | Advanced |
| security-auditor | 5 | 4mo | No flags | Advanced |
Try saying
Example prompts that trigger this skill in your AI assistant.
More by thejefflarson
View all by thejefflarson →You might also like
engineering-advanced-skills
alirezarezvani
25 advanced POWERFUL-tier engineering skills covering agent design, RAG architecture, MCP servers, CI/CD pipelines, database design, observability, security auditing, release management, and platform operations. Works with Claude Code, Codex CLI, and OpenClaw.
agent-security-manager
ruvnet
Agent skill for security-manager - invoke with $agent-security-manager
security-auditor
sickn33
Expert security auditor specializing in DevSecOps, comprehensive cybersecurity, and compliance frameworks. Masters vulnerability assessment, threat modeling, secure authentication (OAuth2/OIDC), OWASP standards, cloud security, and security automation. Handles DevSecOps integration, compliance (GDPR/HIPAA/SOC2), and incident response. Use PROACTIVELY for security audits, DevSecOps, or compliance implementation.
hunt-blueprint-generation
OTRF
Assemble a complete hunt blueprint by consolidating outputs from prior hunt planning skills into a single, structured plan for execution. Use this skill after system and tradecraft research, hunt focus definition, data source identification, and analytics generation have been completed. This skill is synthesis and packaging only and must not introduce new research, assumptions, or analytics.
cosmos-vulnerability-scanner
trailofbits
Scans Cosmos SDK blockchains for 9 consensus-critical vulnerabilities including non-determinism, incorrect signers, ABCI panics, and rounding errors. Use when auditing Cosmos chains or CosmWasm contracts.
openrouter-data-privacy
jeremylongshore
Implement data privacy controls for OpenRouter requests. Use when handling PII or meeting compliance requirements. Trigger with phrases like 'openrouter privacy', 'openrouter pii', 'openrouter gdpr', 'openrouter data protection'.