OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Pass3 providerslatest audit May 8, 2026
Independent checks from skills.sh's audit partners.
The kb-retriever skill implements a local RAG system with hierarchical indexing and progressive retrieval. While it includes safety-oriented instructions such as learning-before-processing, it exposes security surfaces by allowing users to specify arbitrary knowledge base paths and processing untrusted file content. These factors create risks for sensitive data exposure via path manipulation and indirect prompt injection through document content.
Detected behaviors
No alerts
No issues