Security audit
Security checks for vulnerabilities and agentic risk
This database-help skill is not malicious, but its broad activation and unsafe coverage of destructive database operations make it a Review item.
Install only if you want a rough Chinese-language database helper and are prepared to manually review any SQL it suggests. Do not let it run or apply CREATE, DROP, schema, or data-changing commands without confirming the target environment, backups, and rollback plan.
The manifest trigger 'database helper' is generic enough to overlap with common user requests for general database assistance, which weakens invocation scoping. This raises the risk that the skill is selected automatically in situations where its broad, auto-crystallized content is not appropriate or has not been safely constrained.
The trigger phrases are extremely broad database-related terms such as '数据库', 'SQL', and 'schema', so the skill can be invoked during ordinary conversation rather than only when the user explicitly wants this specific capability. In an agent environment, overbroad matching increases the chance of unintended activation and can steer the system into generating or suggesting schema-management actions in the wrong context.
The skill explicitly covers CREATE/DROP DATABASE topics but provides no warning, safety boundary, or confirmation requirement around destructive operations. In practice, an agent using this skill could normalize or recommend deletion-oriented actions without prompting the user to verify environment, backups, or production risk.
The file presents key descriptive and trigger content in Chinese, including user-facing description and activation examples, but does not indicate that the skill is Chinese-only or offer a language/locale choice. This can constitute a language policy issue if users are not given opt-in or an alternative locale.
No suspicious patterns detected.
