ClawHub

tg-mysql-design

Security checks across malware telemetry and agentic risk

Overview

This skill appears to be a coherent MySQL schema-design helper, with some caution needed around broad activation wording and destructive SQL examples.

Install only if you want an assistant to help design MySQL schemas from local Markdown and SQL inputs. Point it at specific files or folders, review generated DDL before use, and avoid running any DROP or rebuild SQL against production databases without backups and explicit confirmation.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The example output includes a destructive statement, `DROP TABLE IF EXISTS`, without any warning, safe-mode guidance, or separation between illustrative DDL and executable migration steps. In a database-design skill, users may copy generated SQL directly into tooling or ask the agent to produce ready-to-run scripts, increasing the risk of accidental data loss or destructive changes in the wrong environment.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The skill advertises activation on a very broad set of common terms such as “DDL”, “CREATE TABLE”, and “表结构设计”, which can match many benign development conversations outside the user’s intent to invoke this specific skill. Over-broad triggering increases the chance the skill reads local `.md` and `.sql` files unnecessarily, causing unintended context capture and possible exposure of sensitive project documentation or schema data.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal