{"id":77106,"plugin_id":"plugins_6ab42163e9048191ab6e8c14258a48c3","kind":"skill","collection_source":"plugin_package","comparison_source":null,"observed_at":"2026-11-03T00:12:26.605Z","digest":"4af7e6cbe1ad934a7fb385676bfba0aabaf919f6ce1ff016b7aff6f3dd41e766","against":null,"payload":{"description":"Review RAG security threats such as prompt injection, poisoned corpora, tenant leakage, secret exposure and tool misuse.","included_files":[],"name":"secure-rag","skill_md_contents":"---\nname: secure-rag\ndescription: Review RAG security threats such as prompt injection, poisoned corpora, tenant leakage, secret exposure and tool misuse.\n---\n\n\n# Security review of RAG\n**Trigger:** Private corpus, tenant separation, sensitive data, prompt injection, resource authorization, poisoned documents or tool-connected RAG.\n\n1. Draw identity and trust boundaries: content ingestion, index/store, metadata filters, cache, retrieval, reranker, context, model, tool invocation, logs and user-facing citations.\n2. Require authoritative ACL/tenant filters before retrieval outputs enter model context. A prompt cannot enforce authorization. Verify cache keys and source-level checks.\n3. Treat documents, web results, PDFs, metadata and traces as untrusted; prevent retrieved instructions from assuming developer/system authority or triggering tools.\n4. Threat model poisoned documents, malicious links, exfiltration via citations/URLs, private embeddings, secrets, PII and unsafe parser execution.\n5. Design least privilege, provenance, safe URL handling, action approvals, scoped logging/redaction and incident alerting.\n6. Add negative tests: cross-tenant query, invalid source ID, malicious instruction in a top result, cache collision, deletion propagation, unauthorized citation.\n7. Report security findings by severity, reproducibility, exposure, containment and verification; avoid overclaiming exploitability.\n\nRead `../../references/security-boundaries.md` and `../../references/security-test-cases.md`.\n"},"changes":[],"summary":"First saved snapshot. No earlier version is available for comparison.","summary_kind":"deterministic","summary_metadata":{}}