agentic-rag-patterns
Audited by Socket on Feb 15, 2026
1 alert found:
Obfuscated FileThis module implements a CRAG workflow but contains multiple coding mistakes and an accidental demo/example block embedded inside generate_answer. The embedded example will cause unexpected network calls (OpenAI/Tavily) and output if executed, representing a privacy/supply-chain risk. No explicit malicious backdoor or obfuscation is evident, but the file is currently non-functional and unsafe to run unchanged. Recommendation: remove or relocate the example/demo code to a separate example file, fix the incomplete 'system =' stubs and undefined functions (build_crag, example_usage), and review any configured API keys and logging before executing. Treat external LLM and web-search calls as sensitive sinks and audit usage policies.