Announcing Beacon: Self-improving memory for coding agents
BeaconIntel
2.9K
← All skills
Skill

rag-architect

skill:jeffallan/claude-skills#rag-architect

Designs and implements production-grade RAG systems by chunking documents, generating embeddings, configuring vector stores, building hybrid search pipelines, applying reranking, and evaluating retrieval quality. Use when building RAG systems, vector databases, or knowledge-grounded AI applications requiring semantic search, document retrieval, context augmentation, similarity search, or embedding-based indexing.

skills.shSkillsMP
Verdict
Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 22:12 UTC at 190e05a

Dispute security verdict

If you believe this verdict is incorrect, submit a dispute and we'll review it.

2
findings
medium
highest severity
1
threat classes
590
files scanned
333/361
checks satisfied
0
package advisories

Why this verdict

  • suspicious: finding skill:skills/rag-architect:skills/rag-architect/references/chunking-strategies.md:733:SUPPLY
  • suspicious: finding skill:skills/rag-architect:skills/rag-architect/references/chunking-strategies.md:736:SUPPLY

Security findings 2

Supply chain

mediumContextual riskmedium confidence

The late-chunking reference example instructs instantiating the unpinned Hugging Face model jinaai/jina-embeddings-v2-base-en with trust_remote_code=True, which executes arbitrary repository-provided code from a mutable remote source if the example is run.

skills/rag-architect/references/chunking-strategies.md:733-735
AutoModel.from_pretrained(model_name, trust_remote_code=True)
vector:code
Counter-argument considered

Strongest case against: this is a common tutorial pattern and the skill's declared purpose includes embedding generation. Strongest case for: the example instructs loading an unpinned, mutable third-party model repo with trust_remote_code=True, which executes repository-provided code at load time; that is not a pinned official-registry install, is not the declared core capability, and no mitigation or pinning exists in the shown unit, so the finding survives all four gates.

Supply chain

mediumContextual riskmedium confidence

The skill's late-chunking example instructs loading the HuggingFace model 'jinaai/jina-embeddings-v2-base-en' with trust_remote_code=True and no pinned revision, causing arbitrary code from the mutable model repository to execute at load time — an undeclared remote-code supply risk beyond the skill's declared RAG-design purpose.

skills/rag-architect/references/chunking-strategies.md:736
self.model = AutoModel.from_pretrained(model_name, trust_remote_code=True)
vector:code
Counter-argument considered

Strongest case against: loading an embedding model is arguably part of the declared embedding-generation capability and this is standard sample code. Strongest case for: the example hardwires an unpinned revision of a third-party model with trust_remote_code=True, so arbitrary repo code runs at load time; the skill declares RAG design, not remote-code execution, and no pin, warning, or mitigation appears in the shown unit, so the undeclared supply-chain finding stands.

Open questions 1

What the analysis could not settle from the code alone.

[file request skills/rag-architect/evaluate.py] The SKILL.md evaluation example comments a command 'python evaluate.py --metrics precision@10 recall@10 mrr --collection knowledge_base'; does this script exist in the artifact, and if so what files, network calls, or writes does it perform?
Code execution

Execution chain 14

What it calls, runs, installs, reads and writes, with the line that does it.

Environment variables 1

COHERE_API_KEY
skills/rag-architect/SKILL.md:139 · instructed

Files read 1

<dynamic>
skills/rag-architect/references/embedding-models.md:455 · instructed

Files written 5

<dynamic>
skills/rag-architect/references/embedding-models.md:461 · instructed
=
skills/rag-architect/SKILL.md:168 · instructed
0,
skills/rag-architect/SKILL.md:128 · instructed
2000
skills/rag-architect/references/vector-databases.md:84 · instructed
8K
skills/rag-architect/references/embedding-models.md:529 · instructed

URLs 7

https://github.com/jeffallan
skills/rag-architect/SKILL.md:201
https://github.com/Jeffallan
skills/rag-architect/SKILL.md:6
https://jeffallan.github.io/claude-skills/skills/data-ml/rag-architect/
skills/rag-architect/SKILL.md:203
https://synergetic.solutions
skills/rag-architect/SKILL.md:7
https://synergetic.solutions
skills/rag-architect/SKILL.md:201
https://your-cluster.qdrant.io
skills/rag-architect/references/vector-databases.md:238
https://your-cluster.weaviate.network
skills/rag-architect/references/vector-databases.md:166

Coverage gaps 31

Parts of the artifact the static analysis could not fully examine.

external_plugin_source plugin 'fullstack-dev-skills' source is not local
.claude-plugin/marketplace.json
ledger_missing run 1: instruction-surface.1 SRC:eaa633ed39e90582
ledger_missing run 1: instruction-surface.1 SRC:a97dd105e3f4a8e7
ledger_missing run 1: instruction-surface.1 SRC:7c5371f6804acdac
ledger_missing run 1: instruction-surface.1 SRC:a5b0dcb019f9b2f9
ledger_missing run 1: instruction-surface.1 SRC:9fe5ae573daccac4
ledger_missing run 1: instruction-surface.1 SRC:0d6d7c4d2b4de7a8
ledger_missing run 1: instruction-surface.1 SRC:f0e827074e7116f0
ledger_missing run 1: instruction-surface.1 SRC:3b301c132f5caf78
ledger_missing run 1: instruction-surface.1 SRC:eadee77c4065bf34
ledger_missing run 1: instruction-surface.1 SRC:0644784dc22d62be
ledger_missing run 1: instruction-surface.1 SRC:d36144e34e682a0c
ledger_missing run 1: instruction-surface.1 SRC:ff3632efb10fbefe
ledger_missing run 1: instruction-surface.1 SRC:94c1872ec40bcceb
ledger_missing run 1: instruction-surface.1 SRC:0f703f6c1a2f3acd
ledger_missing run 1: instruction-surface.1 SRC:2de7eab8d0e1c9ac
ledger_missing run 1: instruction-surface.1 SRC:b21a53046d67a2dd
ledger_missing run 1: instruction-surface.1 SRC:985180cb295e80de
ledger_missing run 1: instruction-surface.1 SRC:ea580aa258207dd5
ledger_missing run 1: instruction-surface.1 SRC:971dc4930b3eeafe
ledger_missing run 1: instruction-surface.1 SRC:136824d12734a39b
ledger_missing run 1: instruction-surface.1 SRC:5316b1ed684bdaab
ledger_missing run 1: instruction-surface.1 SRC:2f31433c97f8eb65
ledger_missing run 1: instruction-surface.1 SRC:75d0ea3ff6bb749e
ledger_missing run 1: instruction-surface.1 SRC:2a3a59dbccf0d316
ledger_missing run 1: instruction-surface.1 SRC:53bb36e52c6a7295
ledger_missing run 1: instruction-surface.1 SRC:5d6d8ffc9f185d96
ledger_missing run 1: instruction-surface.1 SRC:7a7152d7eefae4d5
ledger_missing run 1: instruction-surface.1 SRC:7413b47cbf8fa476
invalid_judge_pass run 1: ['instruction-surface.1']
invalid_judge_finding request.0