hunt-rag-vector

## LLM08 — Vector & Embedding Weaknesses (RAG Pipeline Attacks) `hunt-llm-ai` already owns *session-scoped* indirect injection — a hidden instruction in one document that fires when that specific document is summarized, and ASI06 memory poisoning (a RAG-indexed document that reaches later users). This skill goes one level deeper: it owns the vector **storage and retrieval layer itself** — attacks that don't need any prompt-injection payload at all, because the bug lives in how the embeddings are stored, scoped, and searched. Read `hunt-llm-ai`'s False-Positive Gate first — it applies here unchanged (run-twice rule, anchor to a known secret, cross-tenant proof not assertion, OOB-or-it-didn't-happen for exfil). This document adds gates specific to the vector layer. --- ## Attack Surface Signals - Directly reachable vector-DB ports: Chroma `:8000`, Weaviate `:8080`, Qdrant `:6333`, Milvus `:19530`, Elasticsearch/OpenSearch with `dense_vector`/kNN mappings, managed pgvector via an exposed Postgres port. - A "upload your documents, ask questions about them" feature shared across multiple users or tenants (support-ticket search, internal wiki chatbot, multi-tenant SaaS RAG product). - API responses that include a "similar documents" or "sources" block — check whether it leaks the **raw chunk text** and **document ID** of items outside the querying user's own tenant. - A debug/analytics/admin endpoint that returns raw embedding vectors (`[0.0123, -0.0456, ...]`) rathe...