ClawHub
Back to skill

Security audit

MSSQL

Security checks for vulnerabilities and agentic risk

Overview

This SQL Server skill is understandable in purpose, but it gives an agent unrestricted database power and has unsafe credential/tool loading behavior that users should review before installing.

Install only if you trust the local credential file, the environment used to invoke the skill, and the selected sqlcmd binary. Use a least-privilege SQL Server account, preferably read-only unless writes are truly needed, keep the credential file restricted, and confirm any insert, update, delete, schema, or administrative query before running it.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/mssql_query.sh:4
Finding

Credential File Is Executed as Arbitrary Bash Code

Content
View full analysis

Vulnerability Details

File Location: scripts/mssql_query.sh, lines 4-9
Vulnerability Type: Unsafe execution of a credential configuration file
Risk Level: High

Vulnerable Code

bash
ENV_FILE_DEFAULT="${HOME}/.openclaw/credentials/mssql.env"
ENV_FILE="${MSSQL_ENV_FILE:-$ENV_FILE_DEFAULT}"

if [[ -f "$ENV_FILE" ]]; then
  # shellcheck disable=SC1090
  source "$ENV_FILE"
fi

Technical Analysis

The script uses Bash source to load the MSSQL credential file. source does not treat the file as inert configuration data; it evaluates every line as Bash code in the current process.

Consequently, a credential file can contain command substitutions, function calls, redirections, external command invocations, or arbitrary shell statements. The path is also selectable through the inherited MSSQL_ENV_FILE environment variable. No path, ownership, permission, or content validation occurs before the file is evaluated.

The credential access itself is necessary for the declared MSSQL functionality, but executing the credential file as code exceeds the privileges required. The script only needs to read an allowlisted set of connection parameters.

Attack Path

  1. An attacker gains the ability to influence the invoking environment or write a file accessible to the Agent.
  2. The attacker sets MSSQL_ENV_FILE to the malicious file, or modifies the default file at ~/.openclaw/credentials/mssql.env.
  3. The victim or Agent invokes scripts/mssql_query.sh.
  4. The script evaluates the selected file through source.
  5. Commands embedded in the file execute before credential validation or the MSSQL connection.
  6. The malicious commands can access the invoking process's files, environment, and network capabilities.

Example malicious credential-file content could invoke an arbitrary local program while still defining the expected variables. Exploitation does not require SQL injection or a succes ...[truncated 710 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not use source, ., or eval to read credential files.
  • Parse the file as inert data and allow only the exact supported keys:
    • MSSQL_HOST
    • MSSQL_DB
    • MSSQL_USER
    • MSSQL_PASSWORD
    • MSSQL_PORT
    • MSSQL_ENCRYPT
    • MSSQL_TRUST_CERT
  • Reject unknown keys, duplicate keys, malformed lines, command substitutions, shell expansions, and control characters.
  • Prefer receiving credentials from a protected secret manager or a narrowly controlled process environment.
  • If MSSQL_ENV_FILE remains supported, resolve it to a canonical path and enforce an approved directory policy.
  • Verify that the credential file is a regular file, is owned by the expected user, and is not group- or world-writable.
  • Document and enforce restrictive permissions such as chmod 600 ~/.openclaw/credentials/mssql.env.
  • Validate each parsed value according to its expected type, including numeric ranges for ports and strict enumerations for boolean options.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/mssql_query.sh:73
Finding

Configuration Can Select and Execute an Untrusted SQLCMD Binary

Content
View full analysis

Vulnerability Details

File Location: scripts/mssql_query.sh, lines 73-84 and 101-113
Vulnerability Type: Unvalidated executable-path override
Risk Level: Medium

Vulnerable Code

bash
# Detect sqlcmd binary
SQLCMD_BIN="${SQLCMD_BIN:-}"
if [[ -z "$SQLCMD_BIN" ]]; then
  if [[ -x "/opt/mssql-tools18/bin/sqlcmd" ]]; then
    SQLCMD_BIN="/opt/mssql-tools18/bin/sqlcmd"
  elif command -v sqlcmd >/dev/null 2>&1; then
    SQLCMD_BIN="$(command -v sqlcmd)"
  else
    echo "sqlcmd not found. Install sqlcmd v18+ or set SQLCMD_BIN." >&2
    exit 3
  fi
fi

The selected path is later executed:

bash
CMD=("$SQLCMD_BIN"
  -S "$SERVER"
  -d "$TARGET_DB"
  -U "$MSSQL_USER"
  -b
  -W
  -w 65535
  -s "$DELIM"
  -t "$TIMEOUT"
  "${ENC_FLAGS[@]}"
  -Q "SET NOCOUNT ON; ${QUERY}"
)

run_sqlcmd_clean() {
  # sqlcmd prints a dashes separator on line 2 (right after the header).
  # Remove it only at that position to avoid deleting real data rows.
  "${CMD[@]}" | sed '2{/^[-][- ]*$/d}'
}

Technical Analysis

SQLCMD_BIN can be supplied through the environment or through the sourced credential configuration. The script then executes that path without validating its location, ownership, permissions, file type, or identity.

Bash array construction prevents shell metacharacters in query arguments from becoming ordinary shell-command injection. However, it does not protect against the executable itself being attacker-controlled.

Immediately before execution, the script exports the database password as SQLCMDPASSWORD. Therefore, an attacker-selected executable inherits the password and all other accessible environment values. It also receives the server, database, username, and SQL query through command-line arguments.

Attack Path

  1. An attacker influences the process environment or the MSSQL configuration and sets SQLCMD_BIN to an attacker-control ...[truncated 1316 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove the SQLCMD_BIN environment and credential-file override when operationally feasible.
  • Use a fixed, administrator-controlled absolute path to the trusted sqlcmd executable.
  • If multiple installation paths must be supported, restrict selection to an explicit allowlist of canonical absolute paths.
  • Verify that the selected path is a regular executable file and is owned by a trusted administrative account.
  • Reject executables that are group- or world-writable, symlinks to unapproved locations, or located in user-writable directories.
  • Do not accept executable paths from a file that also stores database credentials.
  • Use a trusted minimal PATH when automatic command discovery is unavoidable.
  • Where practical, verify the executable package, signature, checksum, or other deployment identity.
  • Minimize the lifetime and inheritance scope of SQLCMDPASSWORD; set it only for the trusted child process and unset it immediately afterward.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill description is broad enough to activate on many ordinary data-related requests, including generic reporting, validation, and data management tasks. Because this skill can execute arbitrary SQL queries with the database user's full privileges and imposes no query-type restrictions, over-broad routing increases the chance of unintended database access, modification, or disclosure when the agent selects this skill too eagerly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This code reads and sources an environment file that is expected to contain MSSQL credentials, but there is no warning in comments, help text, or user-facing output that the script will load sensitive credentials from disk. For code files, access to sensitive environment variables or credentials should have some form of disclosure unless already clearly warned elsewhere in the skill description.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.