How to use the Vector and Embedding Security Tester agent skill

What the skill makes the agent do

Once installed, the agent follows a repeatable assessment covering the weakness classes listed in OWASP LLM08:2025 Vector and Embedding Weaknesses. The skill guides checks for embedding inversion (recovering source text from vectors), membership inference (finding out whether a specific record is in the corpus), cross-tenant data leakage, knowledge-base poisoning, and hidden prompt-injection text in retrieved chunks.

The skill names the vector stores it covers: Pinecone, Qdrant, Weaviate, Chroma, pgvector and FAISS. It also includes a Python helper script that runs four of these checks against a Qdrant test instance.

Install the skill from the ZIP download

Download the skill ZIP from this page and unzip it. You can install it in one of two places. For your user account, unzip it into ~/.claude/skills/. For a single project, unzip it into that project's .claude/skills/ folder.

If you use the Claude apps instead, upload the skill under Settings, then Capabilities, then Skills.

• Personal install: ~/.claude/skills/
• Project install: .claude/skills/ inside your project folder
• Claude apps: Settings → Capabilities → Skills, then upload

Prepare Python and a test vector store

The skill's checks run in Python 3.10 or newer. The core packages are numpy, scikit-learn and sentence-transformers. The vector store clients are qdrant-client, chromadb, pinecone-client and weaviate-client. The vec2text package is optional and serves as a research baseline for inversion.

You also need access to a test vector store endpoint, such as a local Qdrant instance at localhost:6333. Poisoning tests write data, so use a test collection and never the production corpus.

• Python 3.10+
• numpy, scikit-learn, sentence-transformers (required Python packages)
• qdrant-client, chromadb, pinecone-client, weaviate-client (for vector store access)
• vec2text (optional research baseline)
• A test endpoint you are authorized to assess

How to trigger the skill with natural requests

You do not need to type a command. Describe the assessment in plain language, and make sure you state that you are authorized to test the system. The skill's description says it is meant for an authorized security assessment of a RAG pipeline's retrieval layer, or for auditing multi-tenant vector store isolation.

Good requests name the system, the scope and the kind of weakness you want to check. Vague requests like 'test my AI' tend to produce generic advice instead of the playbook.

• I am authorized to assess our RAG app. Check whether tenant B can retrieve tenant A's chunks from the test Qdrant collection.
• Run the embedding inversion checks on our embedding model against this test corpus and report how close the reconstructions get.
• Audit our multi-tenant vector store before launch for namespace and metadata filter isolation gaps.
• Test whether documents uploaded by users can insert chunks that dominate retrieval in our test collection.

Understand the checks the agent runs

Inventory comes first: the agent records the embedding model and dimensions, the vector store and its tenancy model, the chunking strategy, the retrieval top_k, the similarity metric, and any metadata filters applied at query time.

For inversion, the skill measures how close a guessed text's embedding is to a target vector, using cosine similarity. A near-verbatim guess with high similarity means inversion risk is real for that model. For membership inference, it compares the top match score for an exact quote from a known chunk against an unrelated control sentence. A large positive difference suggests the item is in the corpus.

For isolation, the agent issues tenant-B queries that should be filtered and verifies that no tenant-A tenant_id appears in results. For poisoning, it inserts benign crafted chunks into a test collection and measures how often they dominate retrieval, and it checks whether indirect prompt-injection text survives in retrieved chunks.

Safety notes: scripts and network access

This skill runs scripts and uses the network. Its helper script connects to a vector store endpoint, and the checks send queries and, for poisoning tests, writes to that endpoint. Read the script before you run it, and point it only at a test instance.

The skill is for systems you own or are authorized to assess. Embedding inversion and cross-tenant probing against systems you do not control may expose third-party data, and the skill says this is prohibited without authorization. Do not run it against production corpora, because poisoning tests write data and could contaminate a live knowledge base.

• Only target endpoints you own or have written authorization to test
• Use a test collection, never production data
• Review scripts/agent.py before running it
• Recommended controls to report: tenant-scoped filters, content validation, embedding-access limits