SurrealDB 3

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:28 PM UTC
• Version: 1.7.1

Overview

This looks like a legitimate SurrealDB helper skill, but it needs review because installation and helper scripts can affect global agent setup and handle live database credentials.

Review before installing globally. Prefer a project-scoped or pinned installation, avoid auto-confirmed npx commands, use read-only or least-privilege SurrealDB credentials, do not run diagnostics against production with root credentials, and avoid generating .env files containing real passwords unless the file permissions and git ignores are verified.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (7)

T08 · Insecure Dependencies

Warning

• Location: README.md:40

Finding

Unpinned npm Package Execution in Primary Installation Instructions

Content

View full analysis

Remediation

View remediation

...`. - Prefer project-scoped installation instead of global installation. - Remove `-y` from the default recommendation so users can inspect prompts. - Publish expected package identity, publisher information, and installer effects. - Use npm lockfiles, signed provenance, and integrity verification where supported. - Offer a pinned Git commit or signed release archive as the recommended audited installation method. ]]>

T08 · Insecure Dependencies

Warning

• Location: skills/surrealmcp/SKILL.md:40

Finding

Mutable Source and Container Images Used for SurrealMCP Installation

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/onboard.py:316

Finding

Plaintext Database Password Written Without Secure File Creation

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: scripts/doctor.py:1

Finding

Unbounded Runtime Dependencies in Database Diagnostic Script

Content

View full analysis

=3.10" # dependencies = [ # "rich>=13.0.0", # "websockets>=12.0", # ] # /// ``` ### Technical Analysis The Skill directs users to run this script with `uv run`. Its PEP 723 dependency declarations use open-ended lower bounds and provide no lockfile, exact versions, or integrity hashes. A future release of either direct or transitive dependency may therefore be downloaded and executed without having been included in the audited Skill artifact. This script is particularly sensitive because it reads SurrealDB credentials from the environment and connects to a configured database endpoint. ### Attack Path 1. A permitted dependency or transitive dependency publishes a compromised release. 2. A user runs `uv run .../scripts/doctor.py`. 3. `uv` resolves and installs the compromised version because it satisfies the open-ended constraint. 4. Dependency code executes during import or script operation. 5. The code can access the process environment, including SurrealDB credentials, and other files available to the user. ### Impact Assessment Exploitation would execute code with the invoking user’s privileges. It could expose database credentials, tamper with diagnostic output, contact unauthorized network endpoints, or modify user-accessible files. ]]>

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: scripts/schema.py:1

Finding

Unbounded Runtime Dependencies in Schema Introspection Script

Content

View full analysis

=3.10" # dependencies = [ # "rich>=13.0.0", # "websockets>=12.0", # ] # /// ``` ### Technical Analysis The PEP 723 dependencies are resolved by `uv run` using open-ended lower bounds. No exact package versions, hashes, or lockfile constrain the executable dependency graph to the versions reviewed with this Skill. The schema script authenticates to SurrealDB and can output complete schema definitions. A compromised dependency would execute in the same process and inherit access to credentials, database metadata, and explicitly selected export paths. ### Attack Path 1. A malicious or compromised dependency version is published. 2. The version satisfies `rich>=13.0.0` or `websockets>=12.0`. 3. A user invokes the schema script through `uv run`. 4. The compromised package is installed and imported. 5. It reads credentials or schema data from the process and can transmit or modify them. ### Impact Assessment The code would run with the user’s local privileges and the database privileges of the configured SurrealDB account. Potential exposure includes authentication secrets, database names, table definitions, indexes, permission predicates, and other schema metadata. ]]>

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: scripts/onboard.py:1

Finding

Unbounded Runtime Dependency in Onboarding Script

Content

View full analysis

=3.10" # dependencies = [ # "rich>=13.0.0", # ] # /// ``` ### Technical Analysis The onboarding script allows `uv` to resolve any future `rich` version at or above 13.0.0, including its permitted transitive dependencies. The dependency graph is not fixed by a lockfile or hashes. This script reads SurrealDB environment variables, prompts for a password, and may write the resulting credentials to `.env`. A compromised runtime dependency would execute within that credential-handling process. ### Attack Path 1. A compromised compatible package release enters the resolved dependency graph. 2. A user invokes onboarding with `uv run`. 3. `uv` retrieves and installs that release. 4. The dependency executes while the script handles environment variables and interactive credentials. 5. Malicious code captures or transmits those values. ### Impact Assessment Exploitation would provide user-level code execution and potential disclosure of SurrealDB credentials entered interactively or inherited from the environment. It could also alter the generated `.env` file or onboarding output. ]]>

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: scripts/check_upstream.py:1

Finding

Unbounded Runtime Dependency in Upstream Repository Checker

Content

View full analysis

=3.10" # dependencies = [ # "rich>=13.0.0", # ] # /// ``` ### Technical Analysis The upstream checker uses an open-ended dependency constraint and is documented for execution through `uv run`. Consequently, its runtime dependency may differ from the version present when the Skill was audited. The script also invokes the authenticated GitHub CLI, `gh api`. Although it passes fixed argument arrays and does not expose command injection, a compromised Python dependency executes in the same environment and could access files or environment variables associated with the user and GitHub CLI session. ### Attack Path 1. A compromised dependency version satisfying `rich>=13.0.0` is published or supplied by a malicious configured index. 2. The user executes the upstream checker with `uv run`. 3. The dependency is installed and imported. 4. Malicious code runs in the process environment used to invoke `gh`. 5. It attempts to access user files, environment variables, or GitHub-related configuration available to the user. ### Impact Assessment The dependency would execute with the invoking user’s local privileges. The direct script only performs read-only public repository checks, but compromised dependency code would not be restricted to that behavior and could access other user-readable resources. ]]>

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (133)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · CHANGELOG.md (reported line 56)May include surrounding context.

md

- Document **GHSA-8rw6-p7m8-63jp** array element-level SELECT permission fix
  (v3.1.4) in `rules/security.md`.
- Retain auditor-safe install guidance: brew/Docker/`surreal upgrade` only — no
  `curl | sh` in skill scripts or primary install paths.
- Built-in MCP stdio owner-level access warning added to MCP rules and AGENTS
  decision tree.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is framed as advisory expertise, but it also instructs execution of health checks that connect to live SurrealDB endpoints, attempt authentication, and inspect server/database state. When operational actions are hidden behind an expert-guidance description, agents or users may invoke it expecting passive advice and instead trigger network access and credentialed database interaction.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is framed as advisory expertise, but it also instructs execution of health checks that connect to live SurrealDB endpoints, attempt authentication, and inspect server/database state. When operational actions are hidden behind an expert-guidance description, agents or users may invoke it expecting passive advice and instead trigger network access and credentialed database interaction.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is framed as advisory expertise, but it also instructs execution of health checks that connect to live SurrealDB endpoints, attempt authentication, and inspect server/database state. When operational actions are hidden behind an expert-guidance description, agents or users may invoke it expecting passive advice and instead trigger network access and credentialed database interaction.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill is framed as advisory expertise, but it also instructs execution of health checks that connect to live SurrealDB endpoints, attempt authentication, and inspect server/database state. When operational actions are hidden behind an expert-guidance description, agents or users may invoke it expecting passive advice and instead trigger network access and credentialed database interaction.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

The skill explicitly accepts database credentials from environment variables and also allows shell execution and local file writing, including creation of a .env file during onboarding. Combining credential access with command execution and file output raises the risk of accidental secret exposure through process arguments, logs, generated files, or downstream tools, especially because the skill also supports networked diagnostics against live endpoints.

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

md

no_credentials_note: "Scripts accept SURREAL_USER/SURREAL_PASS for DB authentication. No credentials are stored in the skill itself."
  no_env_write: true
  no_file_write: false
  no_file_write_note: "schema.py can write exported schema files when --output-dir is set. onboard.py can write a local .env file during interactive setup if the user explicitly confirms."
  no_shell_exec: false
  no_shell_exec_note: "Scripts invoke surreal CLI and gh for health checks."
  scripts_auditable: true

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 180)May include surrounding context.

md

See: `rules/surrealql.md`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 314)May include surrounding context.

md

See: `rules/surrealql.md`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 364)May include surrounding context.

md

See: `rules/surrealql.md`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 192)May include surrounding context.

md

See: `rules/graph-queries.md`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 316)May include surrounding context.

md

See: `rules/graph-queries.md`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 379)May include surrounding context.

md

See: `rules/graph-queries.md`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 204)May include surrounding context.

md

See: `rules/security.md`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 318)May include surrounding context.

md

See: `rules/security.md`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 392)May include surrounding context.

md

See: `rules/security.md`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 222)May include surrounding context.

md

See: `rules/sdks.md`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 321)May include surrounding context.

md

See: `rules/sdks.md`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 332)May include surrounding context.

md

| `rules/gotchas.md` | Cross-domain edge cases and footguns: upgrade, graph, vector, security, MCP, SDKs (v3.1.4+) |

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · rules/gotchas.md (reported line 115)May include surrounding context.

md

| `surreal import --conn` | Flag does not exist | Use `--endpoint` |
| In-memory in production | Data loss on restart | RocksDB / SurrealKV / TiKV for persistence |
| root/root in production | Full compromise | `DEFINE USER` with least privilege |
| `curl \| sh` installers | Supply-chain risk in audited environments | Prefer brew, apt, Docker, or `surreal upgrade` |

---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 87% confidence

Finding

The documentation explicitly encourages reading and logging db.accessToken and db.refreshToken, which can lead developers to expose bearer credentials in application logs, browser consoles, telemetry, or crash reports. In this skill context, the risk is elevated because it is a broad SDK reference likely to be copied verbatim by many users, and refresh tokens in particular can enable session hijacking if captured.

Content

Scanner excerpt · rules/sdks.md (reported line 436)May include surrounding context.

// Access internal state console.log(db.namespace); // current namespace console.log(db.database); // current database console.log(db.accessToken); // current access token console.log(db.refreshToken); // current refresh token console.log(db.params); // defined connection params

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · rules/security.md (reported line 136)May include surrounding context.

md

#### `DURATION FOR { TOKEN | SESSION } <expr>` — Per-User Token / Session Limits

System users (root, namespace, database) issue both a JWT access
token and a server-side session on signin. By default the token
lives for **1 hour** and the session has **no upper bound** until
the user signs out or the server restarts (default token = 3600s

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · rules/security.md (reported line 297)May include surrounding context.

md

#### `DURATION FOR { TOKEN | SESSION } <expr>` — Per-User Token / Session Limits

System users (root, namespace, database) issue both a JWT access
token and a server-side session on signin. By default the token
lives for **1 hour** and the session has **no upper bound** until
the user signs out or the server restarts (default token = 3600s

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · rules/security.md (reported line 298)May include surrounding context.

md

#### `DURATION FOR { TOKEN | SESSION } <expr>` — Per-User Token / Session Limits

System users (root, namespace, database) issue both a JWT access
token and a server-side session on signin. By default the token
lives for **1 hour** and the session has **no upper bound** until
the user signs out or the server restarts (default token = 3600s

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · rules/security.md (reported line 384)May include surrounding context.

md

#### `DURATION FOR { TOKEN | SESSION } <expr>` — Per-User Token / Session Limits

System users (root, namespace, database) issue both a JWT access
token and a server-side session on signin. By default the token
lives for **1 hour** and the session has **no upper bound** until
the user signs out or the server restarts (default token = 3600s

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · rules/security.md (reported line 397)May include surrounding context.

md

#### `DURATION FOR { TOKEN | SESSION } <expr>` — Per-User Token / Session Limits

System users (root, namespace, database) issue both a JWT access
token and a server-side session on signin. By default the token
lives for **1 hour** and the session has **no upper bound** until
the user signs out or the server restarts (default token = 3600s

Static analysis

No suspicious patterns detected.