AI › Module 6 › Lesson 2
RAG and Plugins
RAG and plugin literacy — retrieval trust boundary, tool permissions, indirect injection surface — on `$AI_LAB` RAG stub only.
Visual · t32_rag_and_plugins
RAG and plugins = named trust-boundary rows. $AI_LAB. Original Cyberlium.
Opening
RAG pulls untrusted text into context — name retrieval and plugin permission rows on YOUR lab stack before granting tools to prod agents.
RAG and plugin literacy names: retrieval source trust category, chunk poisoning surface, indirect prompt injection via documents category, plugin/tool permission scope, allowlist vs open tool category, and human-in-the-loop gate for sensitive actions. Analyst documents RAG/plugin threat matrix on `$AI_LAB` instructor RAG stub or YOUR local vector store — maps two indirect injection paths and one excessive plugin permission row — without indexing stranger websites without permission, without auto-executing shell tools on lab default, without plugin abuse against third-party APIs. Cyberlium links Module 3 injection literacy to RAG context — defender vocabulary on YOUR apps. Refused: scrape-and-poison stranger sites, weaponized plugin chains, unauthorized API tool calls. Lab row: RAG/plugin matrix (surface, risk, control) four rows.
1. Named RAG risks
Untrusted retrieval, chunk poisoning, indirect injection, stale context — four literacy anchors.
Trust boundary row states what sources YOUR lab RAG may ingest.
Command guide
Try these commands — Named RAG risks
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
OWASP LLM07/LLM08 — https://owasp.org/www-project-top-10-for-large-language-model-applications/ OpenAI RAG — https://platform.openai.com/docs/guides/retrieval (RAG literacy) NIST AI RMF — https://www.nist.gov/itl/ai-risk-management-framework
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export AI_LAB=${AI_LAB:-$HOME/cyberlium-lab/t32-ai}
cat > "$AI_LAB/owasp/rag-plugins-checklist.md" <<'EOF'
# RAG and Plugins Checklist — YOUR app design
- [ ] Retrieval sources allowlisted and tagged
- [ ] Chunks sanitized; no HTML/JS execution from retrieved text
- [ ] Plugin scopes: least privilege credentials per tool
- [ ] Human approval for destructive plugin actions
- [ ] Log retrieval IDs for incident response
Design notes only — no unauthorized plugin probing on stranger apps
EOFCommand — copy this
grep '\[ \]' "$AI_LAB/owasp/rag-plugins-checklist.md" curl -sS https://cheatsheetseries.owasp.org/cheatsheets/LLM_Top_10_Cheat_Sheet.html | head -8
Primary tools to practice this lesson: grep, curl. Reference sites: OWASP LLM07/LLM08 (https://owasp.org/www-project-top-10-for-large-language-model-applications/); OpenAI RAG (https://platform.openai.com/docs/guides/retrieval); NIST AI RMF (https://www.nist.gov/itl/ai-risk-management-framework). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Plugin permission rows
Tool allowlist, scoped credentials, confirm-before-action, rate limits — four defense anchors.
Excessive agency (LLM08) ties to open plugin design — document restrict row.
3. Refused
No scrape-poison stranger content; no weaponized plugin exploit chains.
RAG literacy supports secure app design — not unauthorized data harvesting.
4. What you ship: RAG/plugin threat matrix
Four surface rows + control each + NEVER weaponized plugin chain line.
5. What you record before the next lesson
RAG/plugin threat matrix path.
6. Wrong vs right: stranger SaaS vs YOUR toy LLM
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Index competitor docs into lab RAG then run injection PoC against their prod bot.
Right
RAG/plugin matrix from `$AI_LAB` stub. Next: Output Handling.
Mission: RAG/plugin threat matrix
1) Name four RAG/plugin risk surfaces. 2) Control row per surface. 3) Link one row to Module 3 injection. 4) Write NEVER weaponized plugin chain line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Human-in-the-loop — minimum gate literacy?”
Knowledge Check
APPLY: RAG literacy uses:
Multiple choice
Knowledge Check
APPLY: True or False: Indirect injection via RAG is a named risk.
True or False
Knowledge Check
APPLY: Plugin defense includes:
Multiple choice