Security audit

SurrealDB 3

Security checks across malware telemetry and agentic risk

Overview

This is a coherent SurrealDB documentation and helper-script skill with disclosed database credential and endpoint use, but users should handle credentials and production database changes carefully.

Install only if you want an agent to help with SurrealDB work. Use local root/root examples only for disposable local databases, prefer least-privilege credentials, avoid putting real passwords directly on command lines, review commands before running them against production, and do not generate a .env with secrets unless the workspace is private and excluded from version control.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The documentation repeatedly includes inline connection strings and passwords in command examples without an accompanying warning to use environment variables, secret stores, or redacted placeholders. In an agent-skill context, users or downstream agents may copy these patterns directly into shells, logs, chat transcripts, or version-controlled configs, increasing the chance of credential exposure during migration and sync operations.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The trigger-based setup guidance tells users to run commands that create triggers and CDC tracking tables, while later sections also state that tables may be created automatically in the target, but there is no prominent warning that the tool changes database structures. In a migration skill, this can cause unintended schema changes, operational disruption, permission issues, or accidental execution against production systems when users assume the commands are read-only.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The documentation states that all filesystem operations are automatically traced via Logfire, but it does not present any user-facing warning about what data may be sent to the telemetry backend. In a filesystem tool for AI agents, traces can easily include filenames, file contents, prompts, or other sensitive workspace data, creating a meaningful privacy and data-leakage risk.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill explicitly describes storing authentication credentials and performing direct record editing, creation, and deletion, but it does not include a clear warning about the sensitivity of credentials or the risk of destructive actions. In an agent-skill context, that omission can lead users or downstream agents to handle secrets unsafely or execute state-changing operations without adequate confirmation, increasing the chance of accidental data loss or credential exposure.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The interactive setup offers to write `SURREAL_PASS` into a `.env` file in plaintext without warning the user about the sensitivity of the secret or restricting file permissions. This can expose database credentials through accidental commits, local disclosure to other users on the system, backups, or workspace sharing.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The markdown examples repeatedly show credentials embedded directly in command lines and connection strings, including database passwords. Even though the values are placeholders, this normalizes insecure operator behavior because shell history, process lists, CI logs, and copied documentation can expose secrets if users follow the pattern with real credentials.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The quick-start instructs users to connect with `--user root --pass root` and does not clearly warn that these are insecure default/example credentials that must not be used beyond a local disposable environment. In an agent skill or copied setup workflow, users may reuse this command verbatim against reachable instances, normalizing privileged default credentials and increasing the risk of unauthorized database access.

External Transmission

Medium

Category: Data Exfiltration
Content: } ``` ### Curl Piping Support SurrealFS supports piping content from external sources:
Confidence: 78% confidence
Finding: Curl Piping Support SurrealFS supports piping content from external sources: ```bash # In the REPL, pipe curl output to a file surrealfs> write_file /data/response.json $(curl -s https://api.example

VirusTotal

59/59 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.