tg-mysql-design

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:52 PM UTC
• Version: 1.0.0

Overview

This MySQL DDL helper is coherent, but it defaults to table-dropping SQL and may read local Markdown or SQL files too broadly, so users should review it before installing.

Install only if you are comfortable reviewing generated SQL before use. Do not run its output directly against any real database without removing or explicitly approving DROP TABLE statements, confirming the target environment, and checking backups. Also expect it may search local Markdown and SQL files unless your agent constrains file access.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: templates/mysql-table-template.sql:1

Finding

Generated SQL Unconditionally Drops Existing Tables

Content

View full analysis

Vulnerability Details

File Locations:

• templates/mysql-table-template.sql:1
• SKILL.md:65
• SKILL.md:132
• README.md:69

Vulnerability Type: Destructive SQL generation without explicit confirmation
Risk Level: Medium

Vulnerable Code Snippet:

sql

DROP TABLE IF EXISTS `[module]_[table_name]`;

The documentation also includes concrete variants of the same pattern:

sql

DROP TABLE IF EXISTS `scm_purchase_contract`;

sql

DROP TABLE IF EXISTS `sm_sales_contract`;

sql

DROP TABLE IF EXISTS `pm_project`;

Technical Analysis

The Skill's standard template and examples unconditionally place DROP TABLE IF EXISTS before the generated CREATE TABLE statement. Dropping an existing table is not required to design or create a new schema and is a destructive operation.

If generated SQL is copied into a database client, deployment pipeline, or migration process, the statement deletes the existing table definition and all records before recreating an empty table. The use of IF EXISTS only suppresses an error when the table is absent; it does not protect existing data.

No confirmation gate, backup verification, migration procedure, environment restriction, or explicit user opt-in is included. Because the Skill also recommends avoiding foreign-key constraints, database-level dependency checks may be less likely to prevent execution.

Attack Path

1. A user asks the Skill to design a table whose generated name matches an existing table.
2. The Skill follows its template and emits DROP TABLE IF EXISTS before CREATE TABLE.
3. The user or an automated process executes the generated script against a development, staging, or production database.
4. MySQL drops the existing table and deletes its stored records.
5. The following CREATE TABLE statement recreates an empty table, potentially concealing the destructive effect until missing data is detected. ...[truncated 988 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove DROP TABLE IF EXISTS from the default template and all documentation examples.

2. Use non-destructive creation for ordinary design output:

   sql

   CREATE TABLE IF NOT EXISTS `[module]_[table_name]` (
     -- Column definitions
   );
   

3. When an existing schema must be changed, generate explicit, reviewable ALTER TABLE migration statements instead of dropping and recreating the table.

4. Only provide destructive replacement SQL when the user explicitly requests it. Place it in a separately labeled section with a prominent data-loss warning.

5. Require confirmation that:

   • The target environment has been identified.
   • A tested backup or rollback plan exists.
   • The executing account is authorized to destroy the table.
   • Dependent objects and data migration requirements have been reviewed.

6. Encourage least-privilege deployment accounts that do not have DROP permission unless a reviewed migration specifically requires it.

7. Add automated linting or tests that reject unconditional DROP TABLE, TRUNCATE TABLE, and similarly destructive statements in default generated output.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The example DDL includes DROP TABLE IF EXISTS, which is a destructive operation that can delete an existing table before recreation. Because the README presents this as a normal output example without any warning, confirmation step, or safer alternative, users may copy and run it in the wrong environment, causing data loss.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger description is broad enough to activate on ordinary database discussions, which can cause the skill to read local .md or .sql files when the user did not clearly intend repository/document analysis. In this skill, that matters because the workflow explicitly instructs use of Read/Glob over business documents and SQL scripts, increasing the chance of overbroad file access and unintended disclosure of project data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill includes destructive SQL examples using DROP TABLE IF EXISTS without warning about data-loss risk. Even though the skill mainly generates text, users may copy and run the output directly; presenting destructive statements as a standard template normalizes potentially irreversible operations and increases accidental data-loss risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

整个技能说明仅以中文呈现，且未说明是否支持其他语言或允许用户自行选择输出语言。根据规则，若技能强制特定语言而没有用户选择或明确合理的区域限定，属于自然语言策略风险。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

In the workflow guidance, status fields are prescribed as CHAR(2), but later the design rules state 使用 VARCHAR 代替 CHAR as a mandatory requirement. These instructions actively conflict and could cause the skill to generate output that violates its own documented standards.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The standard audit-field template shows create_by and update_by as DEFAULT NULL, while the later field-design rules say fields must be NOT NULL with default values, and the example output uses NOT NULL DEFAULT ''. This is an intent-level contradiction inside the skill's own guidance about what it should generate.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The schema comments and enumerated labels are written entirely in Chinese across the template, which imposes a specific language in user-facing metadata without any opt-in or documented locale justification. This matches the language/locale policy category because the file provides natural-language content that is fixed to one locale.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.