surreal-sync

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:29 PM UTC
• Version: 1.2.1

Overview

The skill is a coherent SurrealDB migration helper, but its examples encourage high-impact database syncs with weak operational guardrails.

Review before installing or using this skill in any real environment. Pin and verify the surreal-sync version, use least-privileged database accounts, avoid putting passwords directly in shell commands, use TLS for non-local SurrealDB endpoints, and test migrations against non-production targets before running full sync or CDC.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:35

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 35-36
Vulnerability Type: Unpinned dependency installation
Risk Level: Medium

Vulnerable Code

bash

# Install surreal-sync (Rust binary)
cargo install surreal-sync

Technical Analysis

The installation command does not pin surreal-sync to a specific version and does not use a locked dependency graph. Consequently, it installs whichever package version is current when the command is executed, rather than necessarily installing the upstream release identified in the Skill metadata.

Cargo packages can execute build scripts and compile transitive dependencies during installation. If the package, its registry account, or one of its dependencies is compromised, running this command could execute attacker-controlled build logic and install a malicious binary. The reviewed documentation therefore does not ensure that future users execute the same code associated with the audited snapshot.

Attack Path

1. An attacker compromises the surreal-sync registry package, a maintainer account, or a transitive dependency.
2. The attacker publishes a malicious release or dependency update.
3. A user follows the documented cargo install surreal-sync command.
4. Cargo retrieves the mutable latest release and its dependency graph.
5. Malicious build logic executes with the privileges of the user running Cargo, or a malicious executable is installed.
6. The installed program may subsequently access database credentials and migration data supplied during synchronization.

Impact Assessment

Successful exploitation may allow arbitrary code execution under the installing user's account. Accessible source-database credentials, SurrealDB credentials, local files, environment variables, and migration data could be exposed or modified. If installation is performed by an administrator or privileged automation account, the impact extends to all resources ...[truncated 26 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the package to the reviewed release:

  bash

  cargo install surreal-sync --version 0.3.4 --locked
  

• Confirm that the documented package version corresponds to the repository commit declared in the metadata.
• Verify release provenance and checksums before installation.
• Review and lock transitive dependencies.
• In controlled environments, install from an internally verified artifact repository rather than resolving mutable public-registry content during deployment.
• Run installation and migration under a dedicated, unprivileged account.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:39

Finding

Database Credentials Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 39-45
Vulnerability Type: Sensitive credentials in process arguments and shell history
Risk Level: Medium

Vulnerable Code

bash

surreal-sync from postgres trigger-full \
  --connection-string "postgresql://user:pass@localhost/mydb" \
  --surreal-endpoint "http://localhost:8000" \
  --surreal-username root \
  --surreal-password root \
  --to-namespace prod \
  --to-database main

Equivalent command-line credential patterns are repeated in the other examples in SKILL.md.

Technical Analysis

The documentation instructs users to place source-database and destination-database passwords directly in command-line arguments. The PostgreSQL password is embedded in the connection URI, while the SurrealDB password is supplied through --surreal-password.

Depending on the operating system, shell, runtime environment, and monitoring configuration, command-line arguments may be available through process inspection interfaces, command history, CI/CD logs, audit records, terminal capture, crash diagnostics, or support bundles. Quoting the values prevents shell token splitting but does not keep them secret.

The example also uses the SurrealDB root account, increasing the consequences if the demonstrated credential-handling pattern is copied into a real deployment.

Attack Path

1. An operator replaces the example values with production credentials and runs the documented command.
2. The shell stores the command in history, or the operating system exposes its arguments while the process is running.
3. A local user, monitoring agent, CI log reader, or other principal with access to the recorded command obtains the source and destination credentials.
4. The attacker authenticates directly to PostgreSQL or SurrealDB.
5. The attacker reads, modifies, deletes, or exports data within the permissions granted to the compromised accounts.

...[truncated 530 chars]

Remediation

View remediation

Remediation Suggestions

• Do not place passwords directly in command arguments or connection URIs.
• Support and document secure credential sources such as:
  • Interactive password prompts.
  • Standard-input secret delivery.
  • Protected configuration files with restrictive permissions.
  • Operating-system keychains or dedicated secret managers.
  • Environment-variable references where the environment is adequately protected.
• Ensure secrets are redacted from application, CI/CD, and audit logs.
• Disable or carefully manage shell history for unavoidable secret-bearing commands.
• Replace root with a dedicated migration account that has only the source read and destination write privileges required for synchronization.
• Use explicit placeholders such as ${SURREAL_PASSWORD} rather than realistic default credentials, while documenting the security limitations of the selected secret-delivery mechanism.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:41

Finding

Privileged Database Authentication Demonstrated over Plaintext HTTP

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 41-43
Vulnerability Type: Plaintext transport of database credentials and migration traffic
Risk Level: Medium

Vulnerable Code

bash

  --surreal-endpoint "http://localhost:8000" \
  --surreal-username root \
  --surreal-password root \

The same plaintext SurrealDB endpoint pattern appears throughout the PostgreSQL, MongoDB, JSONL, and Kafka examples.

Technical Analysis

The examples configure the SurrealDB endpoint with HTTP rather than HTTPS while also supplying privileged credentials. Plaintext HTTP does not provide transport confidentiality, integrity, or authenticated server identity.

The literal endpoint is localhost, which limits exposure when the client and database genuinely communicate only over the local loopback interface. However, this documentation is presented as a reusable CLI pattern. If users substitute a remote host, use container networking, traverse a proxy, or otherwise send traffic across an observable network without enabling TLS, credentials and migrated records may be intercepted or modified. The simultaneous use of a root account increases the potential impact of credential interception.

Attack Path

1. A user copies the example and changes the endpoint to a non-loopback host while retaining the http:// scheme.
2. Authentication and synchronization traffic crosses a network without TLS protection.
3. An attacker with a suitable network position observes or manipulates the connection.
4. The attacker captures authentication material or sensitive migration data, or impersonates the destination service.
5. Captured credentials are reused to access SurrealDB, or manipulated responses and requests corrupt the migration.

Impact Assessment

A successful interception may disclose database credentials and all records transferred during migration. Reuse of privileged credentials could provide administrativ ...[truncated 283 chars]

Remediation

View remediation

Remediation Suggestions

• Use an HTTPS endpoint in all examples intended as deployment templates:

  bash

  --surreal-endpoint "https://surrealdb.example.com:8000"
  

• Require TLS certificate validation and document how trusted certificate authorities are configured.
• Do not recommend disabling certificate verification.
• Use mutual TLS where appropriate for production migration infrastructure.
• Restrict plaintext HTTP to explicitly documented loopback-only development scenarios.
• Bind development services only to the loopback interface and prevent unintended network exposure.
• Use a least-privileged migration account rather than the root account.
• Add a warning explaining that credentials and migrated data must never traverse an untrusted network without TLS.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill includes copy-pastable migration and CDC commands that use real credential flags and point at production-style namespaces/databases, but it provides no warning about secret handling, destructive side effects, or the operational risk of syncing into a live SurrealDB instance. In an agent-skill context, users may run these examples verbatim, exposing credentials via shell history/process lists and unintentionally modifying destination data or initiating continuous replication.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.