vector-db-launch — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited vector-db-launch (Agent Skill) and scored it 87/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 3 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 3 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill requires Python 3.8+ and standard library only. No external packages needed.
To install this skill's dependencies:
pip-compile ./requirements.in
pip install -r ./requirements.txtSee ./requirements.txt for the dependency lockfile (currently empty — standard library only).
ChromaDB provides the vector database backend for semantic search. If configured for Option C (Native Server) in vector_profiles.json, the database must be running as a background HTTP service to be accessed by operations.py.
127.0.0.1:8110vector-db-init# Check if ChromaDB is already running
curl -sf http://127.0.0.1:8110/api/v1/heartbeat > /dev/null && echo "✅ ChromaDB running" || echo "❌ ChromaDB not running"If it prints "✅ ChromaDB running", you're done. If not, proceed.
The ChromaDB server runs as a background Python process.
It binds to the ${chroma_host}:${chroma_port} defined in your active profile inside .agent/learning/vector_profiles.json (defaults to 127.0.0.1:8110). Its data volume is mounted from the path defined by the profile's ${chroma_data_path}.
Instruct the user to start the server as a background process using nohup or & so it does not block their terminal. Example:
chroma run --host 127.0.0.1 --port 8110 --path .vector_data &After the user confirms the server is running, verify it via API:
curl -sf http://127.0.0.1:8110/api/v1/heartbeatIt should return a JSON response containing a timestamp {"nanosecond heartbeat": ...}.
| Symptom | Fix |
|---|---|
chroma: command not found | The user hasn't run the vector-db-init skill yet. Run it to pip install chromadb. |
| Port 8110 already in use | Another process (or zombie chroma process) is using the port. lsof -i :8110 to find and kill it. |
| Permission Denied for data directory | Ensure the user has write access to the .vector_data directory. |
If the user decides they do not want to run a background server, you can instruct them to set chroma_host to an empty string "" in their profile in .agent/learning/vector_profiles.json.
The operations.py library will automatically fallback to "Option A" (PersistentClient) and initialize the database locally inside the python process without needing this skill.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.