ClawHub
Back to skill

Security audit

Dev Machine Database

Security checks across malware telemetry and agentic risk

Overview

This database-query skill is not clearly malicious, but it grants broad development-database access with hard-coded root credentials and weak safeguards despite claiming read-only use.

Review this carefully before installing. Only use it in an environment where the datax SSH host and dw database are intended to be accessible, rotate or remove the hard-coded root password, replace it with a least-privileged read-only account, enforce SELECT/SHOW/DESC-only queries with strict table and field allowlists, and require explicit confirmation before posting any database results to Feishu.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
def ssh_command(cmd, timeout=30):
    """执行 SSH 命令"""
    try:
        result = subprocess.run(
            ["ssh", DEV_MACHINE, cmd],
            capture_output=True,
            text=True,
Confidence
88% confidence
Finding
result = subprocess.run( ["ssh", DEV_MACHINE, cmd], capture_output=True, text=True, timeout=timeout )

Intent-Code Divergence

Medium
Confidence
91% confidence
Finding
The skill presents itself as a read-only database query tool, but its documented workflow includes automatically sending query results to Feishu. That creates an undisclosed outbound data transfer path for potentially sensitive records, so the operation is not meaningfully 'read-only' from a data-exposure perspective.

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
The docstring presents this as a database query utility, but query_mysql_docker accepts arbitrary SQL and only auto-appends LIMIT for SELECT statements. That means callers can execute UPDATE, DELETE, DROP, or other destructive statements against the remote database, creating a dangerous mismatch between stated purpose and actual capability.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger phrases are broad and colloquial, which increases the chance the skill activates for casual requests without clear user awareness that it will access a development machine and query a database. In a database-access skill, ambiguous invocation raises the risk of unintended sensitive data retrieval and downstream sharing.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill documentation does not clearly warn users that query results may be transmitted to Feishu, despite the workflow stating this as an output step. Without an explicit user-facing notice, sensitive database contents could be disclosed to a messaging platform unexpectedly.

Missing User Warnings

High
Confidence
99% confidence
Finding
The code hardcodes root database credentials directly in source, exposing privileged access to anyone who can read the file, logs, backups, or repository history. Because the account is root and used for remote access to a live database container, compromise could lead to full database takeover, data theft, tampering, or destruction.

Ssd 3

Medium
Confidence
95% confidence
Finding
Automatically transmitting database query results to Feishu creates a direct exfiltration channel from the development database into a chat system. Because example queries include user and order tables, the exposed data may contain personal, customer, or operationally sensitive records, making the context materially more dangerous.

VirusTotal

55/55 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.