Dev Machine Database

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:41 AM UTC
• Version: 1.0.0

Overview

The skill is meant for database lookup, but it ships powerful hardcoded database access and unsafe command construction that could expose or alter internal data.

Install only in an environment where you control the datax host and the MySQL instance. Before use, rotate the exposed password, remove hardcoded credentials, replace root with a dedicated read-only account, enforce an allowlist for SELECT/SHOW/DESCRIBE-style operations, avoid embedding SQL in SSH shell strings, and require confirmation before sharing database results to Feishu.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: query_db.py:13

Finding

Hardcoded MySQL Root Credentials Exposed in Source and Process Arguments

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: query_db.py:13

Finding

Database Queries Execute with Unnecessary Root Privileges

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: query_db.py:33

Finding

Remote Shell Command Injection Through Unescaped Query Parameters

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: query_db.py:31

Finding

SQL Injection and Failure to Enforce the Documented Read-Only Policy

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly supports querying user-related data and later states results may be sent to Feishu, but it does not warn about privacy, data minimization, or outbound data transfer. This creates a real risk of exfiltrating sensitive personal or business data from an internal database into a chat system without informed user confirmation or policy checks.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The module is presented as a database query tool, but it can execute arbitrary SQL, including INSERT, UPDATE, DELETE, DROP, and administrative statements, against a production-like remote MySQL instance using root credentials. In this context, the mismatch is dangerous because callers may assume read-only behavior while the code permits destructive or privilege-altering operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The code hardcodes MySQL root credentials directly in source, exposing a highly privileged secret to anyone with file access and encouraging reuse of insecure defaults. In this context, compromise of the script or repository immediately grants broad database access and combines with arbitrary SQL execution to enable full data loss or theft.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger phrases are broad and colloquial, making accidental invocation more likely in normal conversation. In this context, accidental activation can lead to unintended access to an internal development host and database, which is more sensitive than a harmless content-generation action.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill claims it is read-only and only executes SELECT statements, but the documented examples and workflow include non-SELECT operations such as SHOW and DESC. This mismatch is dangerous because agents or users may rely on the safety claim and permit broader SQL execution than intended, weakening guardrails around database access.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

md

## 相关文件

- 技能位置：`~/.openclaw/workspace/skills/dev-machine-database/SKILL.md`
- 脚本位置：`~/.openclaw/workspace/skills/dev-machine-database/query_db.py`
- 配置位置：`~/.openclaw/workspace/TOOLS.md` (开发机配置)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill includes a generic SSH execution primitive, not just database access, which materially broadens the attack surface. Given that command strings are composed from variables and SQL text, any injection flaw or future feature expansion could turn this into arbitrary command execution on the remote development machine.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This code executes SSH commands and remotely runs docker exec/mysql against a development machine, which can access and expose database contents. Although the functions have internal docstrings, there is no user-facing warning, confirmation prompt, or disclosure that remote commands will be executed and database data retrieved.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 93% confidence

Finding

The subprocess call itself is not shell=True, but it forwards a fully attacker-controllable remote command string to SSH, which is then interpreted by the remote shell. Because higher-level functions interpolate SQL, table names, and database names directly into that command, this creates a command-injection path on the remote host and extends the tool's power beyond simple database queries.

Content

Scanner excerpt · query_db.py (reported line 22)May include surrounding context.

python

def ssh_command(cmd, timeout=30):
    """执行 SSH 命令"""
    try:
        result = subprocess.run(
            ["ssh", DEV_MACHINE, cmd],
            capture_output=True,
            text=True,

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The module description and user-facing messages are presented exclusively in Chinese, which can amount to a language/locale policy issue when no user opt-in or alternative is offered. There is no indication that this skill is intentionally restricted to a Chinese-speaking or region-specific audience.

Content

No source excerpt is available for this finding.