[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ADVE0HGZKAYP03CQ54R96E":3,"skill-same:01M6ADVE0HGZKAYP03CQ54R96E":101},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":56,"commitSha":57,"skillDirectory":58,"forksCount":59,"repositoryHtmlUrl":60,"repositoryHomepageUrl":61,"ownerHtmlUrl":62,"ownerBlogUrl":63,"ownerDescription":64,"updatedAt":65,"install":66,"resources":79},"01M6ADVE0HGZKAYP03CQ54R96E","assessing-vector-and-embedding-weaknesses",null,"Test RAG vector stores (Pinecone, Qdrant, Weaviate, Chroma, pgvector, FAISS) for embedding inversion, cross-tenant data leakage, and data poisoning per OWASP LLM08:2025. Use when performing an authorized security assessment of a RAG pipeline's retrieval layer or auditing multi-tenant vector-store isolation.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fassessing-vector-and-embedding-weaknesses\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"assessing vector and embedding weaknesses","vector","ai-security","retrieval-augmented-generation","data-poisoning","multi-tenant-isolation","owasp-llm08","rag-security","embedding-inversion","vector-database","security","data","database","assessment","rag","test","cybersecurity","2026-11-10 10:12:30",false,"---\nname: assessing-vector-and-embedding-weaknesses\ndescription: Test RAG vector stores (Pinecone, Qdrant, Weaviate, Chroma, pgvector,\n  FAISS) for embedding inversion, cross-tenant data leakage, and data poisoning per\n  OWASP LLM08:2025. Use when performing an authorized security assessment of a RAG\n  pipeline's retrieval layer or auditing multi-tenant vector-store isolation.\ndomain: cybersecurity\nsubdomain: ai-security\ntags:\n- ai-security\n- vector-database\n- embedding-inversion\n- rag-security\n- owasp-llm08\n- multi-tenant-isolation\n- data-poisoning\n- retrieval-augmented-generation\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_ai_rmf:\n- MEASURE-2.7\natlas_techniques:\n- AML.T0024\n---\n# Assessing Vector and Embedding Weaknesses\n\n> **Authorized use only:** These tests interact with vector stores and embedding models in RAG systems you own or are authorized to assess. Embedding inversion and cross-tenant probing against systems you do not control may expose third-party data and is prohibited without authorization.\n\n## Overview\n\nRetrieval-Augmented Generation (RAG) systems convert documents into embedding vectors stored in a vector database (Pinecone, Qdrant, Weaviate, Chroma, pgvector, FAISS) and retrieve the nearest vectors to ground LLM responses. OWASP **LLM08:2025 Vector and Embedding Weaknesses** covers the security risks unique to this layer:\n\n- **Embedding inversion** — embeddings are not one-way. A trained inversion model (or a black-box reconstruction attack) can recover substantial portions of the original text from its vector, leaking source documents (maps to MITRE ATLAS **AML.T0024.001 Invert ML Model**).\n- **Membership inference** — querying whether a specific record contributed to the corpus (AML.T0024.000).\n- **Cross-tenant \u002F multi-tenant leakage** — when one namespace\u002Fcollection is shared or filter isolation is missing, a tenant retrieves another tenant's chunks.\n- **Knowledge-base poisoning** — an attacker who can write to the corpus inserts crafted chunks that dominate retrieval (high cosine similarity to expected queries) and carry indirect prompt-injection payloads.\n- **Retrieval manipulation** — adversarial documents tuned to be retrieved for many unrelated queries (\"retrieval hijacking\").\n\nThe parent technique is **AML.T0024 — Exfiltration via ML Inference API**: an attacker uses legitimate inference\u002Fquery access to exfiltrate data (source text via inversion, membership, or model extraction). This skill provides a repeatable assessment of all five weakness classes.\n\n## When to Use\n\n- During a security assessment of any RAG \u002F vector-search application (OWASP LLM08 coverage).\n- When a vector store is multi-tenant and you must prove namespace\u002Fmetadata isolation.\n- When the corpus accepts user-supplied or third-party documents (poisoning surface).\n- When the embedding endpoint is externally reachable (inversion\u002Fmembership surface).\n- When validating retrieval-filtering controls before go-live.\n\n## Prerequisites\n\n- Authorization and scope covering the target embedding endpoint and vector store.\n- Python 3.10+.\n- Read (and, for poisoning tests, write) access to a test collection — never the production corpus.\n\n```bash\n# Vector DB clients + embeddings + similarity tooling\npython -m pip install numpy scikit-learn sentence-transformers\npython -m pip install qdrant-client chromadb pinecone-client weaviate-client\n# (optional) text-embedding inversion research baseline\npython -m pip install vec2text\n```\n\n## Objectives\n\n- Measure embedding-inversion exposure on the target embedding model.\n- Run a membership-inference probe against the corpus.\n- Test multi-tenant isolation (namespace, metadata filter, RBAC) for cross-tenant leakage.\n- Inject benign poisoned chunks into a *test* collection and measure retrieval dominance.\n- Detect indirect prompt-injection content surviving in retrieved chunks.\n- Recommend controls: tenant-scoped filters, content validation, embedding-access limits.\n\n## MITRE ATT&CK Mapping\n\n| ID | Tactic | Official Technique Name | Role in this skill |\n|----|--------|-------------------------|--------------------|\n| AML.T0024 | ATLAS: Exfiltration | Exfiltration via ML Inference API | Using query\u002Fembedding access to exfiltrate source data |\n| AML.T0024.000 | ATLAS: Exfiltration | Infer Training Data Membership | Membership-inference probe against the corpus |\n| AML.T0024.001 | ATLAS: Exfiltration | Invert ML Model | Embedding-inversion reconstruction of source text |\n| AML.T0020 | ATLAS: Resource Development | Poison Training Data | Knowledge-base poisoning of the corpus |\n| AML.T0051.001 | ATLAS: Initial Access | LLM Prompt Injection: Indirect | Injection payloads embedded in retrieved chunks |\n\n## Workflow\n\n### Step 1: Inventory the RAG pipeline\n\nDocument the embedding model + dimensions, the vector store and its tenancy model, the chunking strategy, retrieval `top_k` and similarity metric (cosine\u002Fdot\u002FL2), and any metadata filters applied at query time.\n\n```python\n# Example: inspect a Qdrant collection\nfrom qdrant_client import QdrantClient\nclient = QdrantClient(url=\"http:\u002F\u002Flocalhost:6333\")\ninfo = client.get_collection(\"docs\")\nprint(info.config.params.vectors)   # size + distance metric\nprint(client.count(\"docs\"))         # corpus size\n```\n\n### Step 2: Test embedding-inversion exposure\n\nEmbeddings of similar text are close; an attacker with the embedding endpoint can iteratively reconstruct text whose embedding matches a target vector. Measure how much a nearest-neighbour-in-embedding-space recovers, using cosine similarity between candidate reconstructions and the target.\n\n```python\nimport numpy as np\nfrom sentence_transformers import SentenceTransformer\nfrom sklearn.metrics.pairwise import cosine_similarity\n\nmodel = SentenceTransformer(\"all-MiniLM-L6-v2\")\nsecret = \"Patient John Doe, MRN 553120, diagnosed with hypertension.\"\ntarget_vec = model.encode([secret])\n\n# Attacker has only target_vec and the embedding endpoint. Hill-climb candidate text.\ncandidates = [\n    \"Patient name and medical record number with a diagnosis.\",\n    \"John Doe medical record hypertension diagnosis\",\n    \"Patient John Doe MRN diagnosed hypertension\",\n]\ncand_vecs = model.encode(candidates)\nsims = cosine_similarity(target_vec, cand_vecs)[0]\nfor c, s in sorted(zip(candidates, sims), key=lambda x: -x[1]):\n    print(f\"{s:.3f}  {c}\")\n# High similarity for a near-verbatim guess => inversion risk is real for this model.\n```\n\nFor a research-grade reconstruction baseline, `vec2text` can be used against compatible embedding models to demonstrate full-text recovery.\n\n### Step 3: Membership inference\n\nDetermine whether a specific document is in the corpus by measuring the top-1 retrieval similarity for an exact-quote query: in-corpus items return a markedly higher max similarity than out-of-corpus controls.\n\n```python\ndef membership_score(client, collection, embed, text):\n    vec = embed([text])[0].tolist()\n    hits = client.search(collection_name=collection, query_vector=vec, limit=1)\n    return hits[0].score if hits else 0.0\n\nin_corpus = membership_score(client, \"docs\", model.encode, \"\u003Cexact quote from a known chunk>\")\ncontrol  = membership_score(client, \"docs\", model.encode, \"An unrelated random sentence.\")\nprint(f\"in-corpus={in_corpus:.3f}  control={control:.3f}  delta={in_corpus-control:.3f}\")\n# A large positive delta indicates the item is in the corpus (membership leak).\n```\n\n### Step 4: Test multi-tenant isolation\n\nConfirm that tenant B cannot retrieve tenant A's chunks. Issue tenant-B-authenticated queries that *should* be filtered, and verify no tenant-A `tenant_id` appears in results.\n\n```python\n# Query as tenant B; expect ONLY tenant_id == \"B\" results.\nfrom qdrant_client.models import Filter, FieldCondition, MatchValue\n\nvec = model.encode([\"confidential salary information\"])[0].tolist()\nhits = client.search(\n    collection_name=\"docs\",\n    query_vector=vec,\n    limit=10,\n    query_filter=Filter(must=[FieldCondition(key=\"tenant_id\", match=MatchValue(value=\"B\"))]),\n)\nleaked = [h for h in hits if h.payload.get(\"tenant_id\") != \"B\"]\nprint(\"CROSS-TENANT LEAK\" if leaked else \"isolation OK\", \"->\", len(leaked), \"foreign rows\")\n\n# Critical test: repeat WITHOUT the filter to confirm the server, not the client,\n# enforces isolation. If unfiltered queries return tenant A data, isolation is client-side only.\nhits_nofilter = client.search(collection_name=\"docs\", query_vector=vec, limit=10)\nprint(\"server-side isolation FAILS\" if any(h.payload.get(\"tenant_id\") != \"B\" for h in hits_nofilter) else \"OK\")\n```\n\n### Step 5: Knowledge-base poisoning (test collection only)\n\nInsert a benign poisoned chunk crafted to be retrieved for many unrelated queries, then measure how often it appears in `top_k`.\n\n```python\nfrom qdrant_client.models import PointStruct\n\n# Benign marker payload (no real injection) to measure retrieval dominance.\npoison = \"POISON-CANARY. \" + \" \".join(\n    [\"password reset billing refund account login support error help\"] * 8\n)\nclient.upsert(\"docs_test\", points=[\n    PointStruct(id=999999, vector=model.encode([poison])[0].tolist(),\n                payload={\"tenant_id\": \"B\", \"source\": \"poison-test\"})\n])\n\nqueries = [\"how do I get a refund\", \"reset my password\", \"what is the weather\"]\nfor q in queries:\n    hits = client.search(\"docs_test\", model.encode([q])[0].tolist(), limit=5)\n    dominated = any(h.payload.get(\"source\") == \"poison-test\" for h in hits)\n    print(f\"{'POISON in top5' if dominated else 'clean'}: {q}\")\n```\n\n### Step 6: Detect indirect prompt injection in retrieved chunks\n\nScan retrieved chunk text for injection markers before it is concatenated into the prompt.\n\n```python\nimport re\nINJECTION_PATTERNS = [\n    r\"ignore (all|previous|the above) instructions\",\n    r\"system prompt\", r\"you are now\", r\"disregard\", r\"\u003C\u002F?(system|instructions)>\",\n]\ndef chunk_is_injection(text):\n    low = text.lower()\n    return [p for p in INJECTION_PATTERNS if re.search(p, low)]\n\nfor hit in client.search(\"docs\", model.encode([\"help\"])[0].tolist(), limit=10):\n    flags = chunk_is_injection(hit.payload.get(\"text\", \"\"))\n    if flags:\n        print(\"INDIRECT INJECTION in chunk\", hit.id, flags)\n```\n\n### Step 7: Report and remediate\n\n- **Inversion\u002Fmembership:** rate-limit and authenticate the embedding endpoint; avoid returning raw similarity scores; restrict who can query embeddings.\n- **Cross-tenant:** enforce tenant filters server-side (separate collections\u002Fnamespaces per tenant where feasible); never rely on client-supplied filters.\n- **Poisoning:** validate and provenance-tag every ingested chunk; scan inputs for injection; cap any single source's share of retrieval.\n- **Indirect injection:** sanitize retrieved chunks and apply output guardrails (see `defending-llms-with-guardrails`).\n\n## Tools and Resources\n\n| Tool | Purpose | Primary Source |\n|------|---------|----------------|\n| OWASP LLM08 | Vector and Embedding Weaknesses guidance | https:\u002F\u002Fgenai.owasp.org\u002Fllmrisk\u002Fllm082025-vector-and-embedding-weaknesses\u002F |\n| sentence-transformers | Embedding generation for testing | https:\u002F\u002Fwww.sbert.net\u002F |\n| Qdrant client | Vector store + filtered search | https:\u002F\u002Fqdrant.tech\u002Fdocumentation\u002F |\n| Chroma \u002F Weaviate \u002F Pinecone | Alternative vector stores | https:\u002F\u002Fdocs.trychroma.com\u002F |\n| vec2text | Embedding-inversion research baseline | https:\u002F\u002Fgithub.com\u002Fjxmorris12\u002Fvec2text |\n| MITRE ATLAS | AML.T0024 Exfiltration via ML Inference API | https:\u002F\u002Fatlas.mitre.org\u002F |\n\n## Validation Criteria\n\n- [ ] RAG pipeline inventoried (embedding model, store, tenancy, metric, top_k, filters).\n- [ ] Embedding-inversion exposure measured and rated.\n- [ ] Membership-inference delta computed for in-corpus vs control items.\n- [ ] Multi-tenant isolation tested both with and without client filters (server-side enforcement confirmed).\n- [ ] Poisoning dominance measured in a test collection only.\n- [ ] Retrieved chunks scanned for indirect-injection content.\n- [ ] Findings reported with remediation for each weakness class.\n- [ ] No production corpus modified during the assessment.\n","# Assessing Vector and Embedding Weaknesses\n\n> **Authorized use only:** These tests interact with vector stores and embedding models in RAG systems you own or are authorized to assess. Embedding inversion and cross-tenant probing against systems you do not control may expose third-party data and is prohibited without authorization.\n\n## Overview\n\nRetrieval-Augmented Generation (RAG) systems convert documents into embedding vectors stored in a vector database (Pinecone, Qdrant, Weaviate, Chroma, pgvector, FAISS) and retrieve the nearest vectors to ground LLM responses. OWASP **LLM08:2025 Vector and Embedding Weaknesses** covers the security risks unique to this layer:\n\n- **Embedding inversion** — embeddings are not one-way. A trained inversion model (or a black-box reconstruction attack) can recover substantial portions of the original text from its vector, leaking source documents (maps to MITRE ATLAS **AML.T0024.001 Invert ML Model**).\n- **Membership inference** — querying whether a specific record contributed to the corpus (AML.T0024.000).\n- **Cross-tenant \u002F multi-tenant leakage** — when one namespace\u002Fcollection is shared or filter isolation is missing, a tenant retrieves another tenant's chunks.\n- **Knowledge-base poisoning** — an attacker who can write to the corpus inserts crafted chunks that dominate retrieval (high cosine similarity to expected queries) and carry indirect prompt-injection payloads.\n- **Retrieval manipulation** — adversarial documents tuned to be retrieved for many unrelated queries (\"retrieval hijacking\").\n\nThe parent technique is **AML.T0024 — Exfiltration via ML Inference API**: an attacker uses legitimate inference\u002Fquery access to exfiltrate data (source text via inversion, membership, or model extraction). This skill provides a repeatable assessment of all five weakness classes.\n\n## When to Use\n\n- During a security assessment of any RAG \u002F vector-search application (OWASP LLM08 coverage).\n- When a vector store is multi-tenant and you must prove namespace\u002Fmetadata isolation.\n- When the corpus accepts user-supplied or third-party documents (poisoning surface).\n- When the embedding endpoint is externally reachable (inversion\u002Fmembership surface).\n- When validating retrieval-filtering controls before go-live.\n\n## Prerequisites\n\n- Authorization and scope covering the target embedding endpoint and vector store.\n- Python 3.10+.\n- Read (and, for poisoning tests, write) access to a test collection — never the production corpus.\n\n```bash\n# Vector DB clients + embeddings + similarity tooling\npython -m pip install numpy scikit-learn sentence-transformers\npython -m pip install qdrant-client chromadb pinecone-client weaviate-client\n# (optional) text-embedding inversion research baseline\npython -m pip install vec2text\n```\n\n## Objectives\n\n- Measure embedding-inversion exposure on the target embedding model.\n- Run a membership-inference probe against the corpus.\n- Test multi-tenant isolation (namespace, metadata filter, RBAC) for cross-tenant leakage.\n- Inject benign poisoned chunks into a *test* collection and measure retrieval dominance.\n- Detect indirect prompt-injection content surviving in retrieved chunks.\n- Recommend controls: tenant-scoped filters, content validation, embedding-access limits.\n\n## MITRE ATT&CK Mapping\n\n| ID | Tactic | Official Technique Name | Role in this skill |\n|----|--------|-------------------------|--------------------|\n| AML.T0024 | ATLAS: Exfiltration | Exfiltration via ML Inference API | Using query\u002Fembedding access to exfiltrate source data |\n| AML.T0024.000 | ATLAS: Exfiltration | Infer Training Data Membership | Membership-inference probe against the corpus |\n| AML.T0024.001 | ATLAS: Exfiltration | Invert ML Model | Embedding-inversion reconstruction of source text |\n| AML.T0020 | ATLAS: Resource Development | Poison Training Data | Knowledge-base poisoning of the corpus |\n| AML.T0051.001 | ATLAS: Initial Access | LLM Prompt Injection: Indirect | Injection payloads embedded in retrieved chunks |\n\n## Workflow\n\n### Step 1: Inventory the RAG pipeline\n\nDocument the embedding model + dimensions, the vector store and its tenancy model, the chunking strategy, retrieval `top_k` and similarity metric (cosine\u002Fdot\u002FL2), and any metadata filters applied at query time.\n\n```python\n# Example: inspect a Qdrant collection\nfrom qdrant_client import QdrantClient\nclient = QdrantClient(url=\"http:\u002F\u002Flocalhost:6333\")\ninfo = client.get_collection(\"docs\")\nprint(info.config.params.vectors)   # size + distance metric\nprint(client.count(\"docs\"))         # corpus size\n```\n\n### Step 2: Test embedding-inversion exposure\n\nEmbeddings of similar text are close; an attacker with the embedding endpoint can iteratively reconstruct text whose embedding matches a target vector. Measure how much a nearest-neighbour-in-embedding-space recovers, using cosine similarity between candidate reconstructions and the target.\n\n```python\nimport numpy as np\nfrom sentence_transformers import SentenceTransformer\nfrom sklearn.metrics.pairwise import cosine_similarity\n\nmodel = SentenceTransformer(\"all-MiniLM-L6-v2\")\nsecret = \"Patient John Doe, MRN 553120, diagnosed with hypertension.\"\ntarget_vec = model.encode([secret])\n\n# Attacker has only target_vec and the embedding endpoint. Hill-climb candidate text.\ncandidates = [\n    \"Patient name and medical record number with a diagnosis.\",\n    \"John Doe medical record hypertension diagnosis\",\n    \"Patient John Doe MRN diagnosed hypertension\",\n]\ncand_vecs = model.encode(candidates)\nsims = cosine_similarity(target_vec, cand_vecs)[0]\nfor c, s in sorted(zip(candidates, sims), key=lambda x: -x[1]):\n    print(f\"{s:.3f}  {c}\")\n# High similarity for a near-verbatim guess => inversion risk is real for this model.\n```\n\nFor a research-grade reconstruction baseline, `vec2text` can be used against compatible embedding models to demonstrate full-text recovery.\n\n### Step 3: Membership inference\n\nDetermine whether a specific document is in the corpus by measuring the top-1 retrieval similarity for an exact-quote query: in-corpus items return a markedly higher max similarity than out-of-corpus controls.\n\n```python\ndef membership_score(client, collection, embed, text):\n    vec = embed([text])[0].tolist()\n    hits = client.search(collection_name=collection, query_vector=vec, limit=1)\n    return hits[0].score if hits else 0.0\n\nin_corpus = membership_score(client, \"docs\", model.encode, \"\u003Cexact quote from a known chunk>\")\ncontrol  = membership_score(client, \"docs\", model.encode, \"An unrelated random sentence.\")\nprint(f\"in-corpus={in_corpus:.3f}  control={control:.3f}  delta={in_corpus-control:.3f}\")\n# A large positive delta indicates the item is in the corpus (membership leak).\n```\n\n### Step 4: Test multi-tenant isolation\n\nConfirm that tenant B cannot retrieve tenant A's chunks. Issue tenant-B-authenticated queries that *should* be filtered, and verify no tenant-A `tenant_id` appears in results.\n\n```python\n# Query as tenant B; expect ONLY tenant_id == \"B\" results.\nfrom qdrant_client.models import Filter, FieldCondition, MatchValue\n\nvec = model.encode([\"confidential salary information\"])[0].tolist()\nhits = client.search(\n    collection_name=\"docs\",\n    query_vector=vec,\n    limit=10,\n    query_filter=Filter(must=[FieldCondition(key=\"tenant_id\", match=MatchValue(value=\"B\"))]),\n)\nleaked = [h for h in hits if h.payload.get(\"tenant_id\") != \"B\"]\nprint(\"CROSS-TENANT LEAK\" if leaked else \"isolation OK\", \"->\", len(leaked), \"foreign rows\")\n\n# Critical test: repeat WITHOUT the filter to confirm the server, not the client,\n# enforces isolation. If unfiltered queries return tenant A data, isolation is client-side only.\nhits_nofilter = client.search(collection_name=\"docs\", query_vector=vec, limit=10)\nprint(\"server-side isolation FAILS\" if any(h.payload.get(\"tenant_id\") != \"B\" for h in hits_nofilter) else \"OK\")\n```\n\n### Step 5: Knowledge-base poisoning (test collection only)\n\nInsert a benign poisoned chunk crafted to be retrieved for many unrelated queries, then measure how often it appears in `top_k`.\n\n```python\nfrom qdrant_client.models import PointStruct\n\n# Benign marker payload (no real injection) to measure retrieval dominance.\npoison = \"POISON-CANARY. \" + \" \".join(\n    [\"password reset billing refund account login support error help\"] * 8\n)\nclient.upsert(\"docs_test\", points=[\n    PointStruct(id=999999, vector=model.encode([poison])[0].tolist(),\n                payload={\"tenant_id\": \"B\", \"source\": \"poison-test\"})\n])\n\nqueries = [\"how do I get a refund\", \"reset my password\", \"what is the weather\"]\nfor q in queries:\n    hits = client.search(\"docs_test\", model.encode([q])[0].tolist(), limit=5)\n    dominated = any(h.payload.get(\"source\") == \"poison-test\" for h in hits)\n    print(f\"{'POISON in top5' if dominated else 'clean'}: {q}\")\n```\n\n### Step 6: Detect indirect prompt injection in retrieved chunks\n\nScan retrieved chunk text for injection markers before it is concatenated into the prompt.\n\n```python\nimport re\nINJECTION_PATTERNS = [\n    r\"ignore (all|previous|the above) instructions\",\n    r\"system prompt\", r\"you are now\", r\"disregard\", r\"\u003C\u002F?(system|instructions)>\",\n]\ndef chunk_is_injection(text):\n    low = text.lower()\n    return [p for p in INJECTION_PATTERNS if re.search(p, low)]\n\nfor hit in client.search(\"docs\", model.encode([\"help\"])[0].tolist(), limit=10):\n    flags = chunk_is_injection(hit.payload.get(\"text\", \"\"))\n    if flags:\n        print(\"INDIRECT INJECTION in chunk\", hit.id, flags)\n```\n\n### Step 7: Report and remediate\n\n- **Inversion\u002Fmembership:** rate-limit and authenticate the embedding endpoint; avoid returning raw similarity scores; restrict who can query embeddings.\n- **Cross-tenant:** enforce tenant filters server-side (separate collections\u002Fnamespaces per tenant where feasible); never rely on client-supplied filters.\n- **Poisoning:** validate and provenance-tag every ingested chunk; scan inputs for injection; cap any single source's share of retrieval.\n- **Indirect injection:** sanitize retrieved chunks and apply output guardrails (see `defending-llms-with-guardrails`).\n\n## Tools and Resources\n\n| Tool | Purpose | Primary Source |\n|------|---------|----------------|\n| OWASP LLM08 | Vector and Embedding Weaknesses guidance | https:\u002F\u002Fgenai.owasp.org\u002Fllmrisk\u002Fllm082025-vector-and-embedding-weaknesses\u002F |\n| sentence-transformers | Embedding generation for testing | https:\u002F\u002Fwww.sbert.net\u002F |\n| Qdrant client | Vector store + filtered search | https:\u002F\u002Fqdrant.tech\u002Fdocumentation\u002F |\n| Chroma \u002F Weaviate \u002F Pinecone | Alternative vector stores | https:\u002F\u002Fdocs.trychroma.com\u002F |\n| vec2text | Embedding-inversion research baseline | https:\u002F\u002Fgithub.com\u002Fjxmorris12\u002Fvec2text |\n| MITRE ATLAS | AML.T0024 Exfiltration via ML Inference API | https:\u002F\u002Fatlas.mitre.org\u002F |\n\n## Validation Criteria\n\n- [ ] RAG pipeline inventoried (embedding model, store, tenancy, metric, top_k, filters).\n- [ ] Embedding-inversion exposure measured and rated.\n- [ ] Membership-inference delta computed for in-corpus vs control items.\n- [ ] Multi-tenant isolation tested both with and without client filters (server-side enforcement confirmed).\n- [ ] Poisoning dominance measured in a test collection only.\n- [ ] Retrieved chunks scanned for indirect-injection content.\n- [ ] Findings reported with remediation for each weakness class.\n- [ ] No production corpus modified during the assessment.\n",{"name":5,"tags":49,"author":50,"domain":43,"license":15,"version":51,"subdomain":29,"description":7,"nist_ai_rmf":52,"atlas_techniques":54},[29,36,35,34,33,32,31,30],"mahipal","1.0",[53],"MEASURE-2.7",[55],"AML.T0024","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fassessing-vector-and-embedding-weaknesses",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":67,"prompt":77,"zipAvailable":78},[68,71,74],{"tool":69,"command":70},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill assessing-vector-and-embedding-weaknesses",{"tool":72,"command":73},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill assessing-vector-and-embedding-weaknesses",{"tool":75,"command":76},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill assessing-vector-and-embedding-weaknesses","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fassessing-vector-and-embedding-weaknesses\u002FSKILL.md",true,[80,85,91,95],{"path":81,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":83,"sourceHtmlUrl":84},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fassessing-vector-and-embedding-weaknesses\u002FLICENSE",{"path":86,"resourceType":87,"resourceTypeDesc":88,"sizeBytes":89,"sourceHtmlUrl":90},"references\u002Fapi-reference.md","REFERENCE","参考文档",2344,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fassessing-vector-and-embedding-weaknesses\u002Freferences\u002Fapi-reference.md",{"path":92,"resourceType":87,"resourceTypeDesc":88,"sizeBytes":93,"sourceHtmlUrl":94},"references\u002Fstandards.md",1958,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fassessing-vector-and-embedding-weaknesses\u002Freferences\u002Fstandards.md",{"path":96,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":99,"sourceHtmlUrl":100},"scripts\u002Fagent.py","SCRIPT","脚本",5982,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fassessing-vector-and-embedding-weaknesses\u002Fscripts\u002Fagent.py",[102,128,152,178,203,230],{"skillNo":103,"name":104,"nameZh":6,"description":105,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":106,"categories":107,"keywords":109,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[108],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[110,111,112,113,37,43,114,115,116,117,118,119,120,121,122,123,124,125,126,127],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":129,"name":130,"nameZh":6,"description":131,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":132,"categories":133,"keywords":135,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[134],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[136,124,137,138,37,139,43,116,140,141,142,143,144,145,146,147,148,149,150,151],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":153,"name":154,"nameZh":6,"description":155,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":156,"categories":157,"keywords":160,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[158,159],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[146,161,162,163,164,43,165,166,140,167,168,169,170,171,172,173,174,175,176,177],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":179,"name":180,"nameZh":6,"description":181,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":182,"categories":183,"keywords":185,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[184],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[186,187,188,43,189,190,191,192,193,194,195,38,196,197,198,199,143,200,201,202],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":204,"name":205,"nameZh":6,"description":206,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":207,"categories":208,"keywords":210,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[209],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[211,212,213,43,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":231,"name":232,"nameZh":6,"description":233,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":234,"categories":235,"keywords":237,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[236],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[37,238,43,239,240,241,242,243,244,245,246,173,247,174,248,249,250,251,252,253],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]