ClawHub
Back to skill

Security audit

database-operations

Security checks for vulnerabilities and agentic risk

Overview

This database-help skill is mostly coherent, but it includes external API examples that can send sensitive query plans or schema details to a third party without clear consent or redaction guidance.

Review before installing if you work with production, regulated, or confidential databases. Do not send real query plans, schema names, tenant identifiers, literals, credentials, or connection details to the SkillBoss API unless your organization has approved that service and you have redacted the payload. For local-only database advice, avoid using the external API snippets.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:360
Finding

Unredacted Database Query Plans May Be Disclosed to an External Service

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 360–380
Vulnerability Type: Sensitive information transmitted to a third-party API without redaction or explicit consent
Risk Level: Medium

Vulnerable Code

python
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]
API_BASE = "https://api.heybossai.com/v1"

def pilot(body: dict) -> dict:
    r = requests.post(
        f"{API_BASE}/pilot",
        headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
        json=body,
        timeout=60,
    )
    return r.json()

# AI-assisted query analysis through the SkillBoss API Hub chat capability
def analyze_slow_query(query_plan: str) -> str:
    result = pilot({
        "type": "chat",
        "inputs": {
            "messages": [
                {"role": "user", "content": f"Analyze this PostgreSQL query plan and suggest optimizations:\n{query_plan}"}
            ]
        },
        "prefer": "balanced"
    })
    return result["result"]["choices"][0]["message"]["content"]

Technical Analysis

The example submits the complete query_plan value to https://api.heybossai.com/v1/pilot. Production query plans can expose SQL text, schema names, table and column names, business logic, tenant identifiers, literal query values, cardinality information, and other sensitive operational metadata.

The Skill does not require redaction, content minimization, user confirmation, destination allowlisting, or review of the third party's retention and privacy terms before transmission. External disclosure is not essential to the Skill's core database-optimization functionality because query plans can be analyzed locally. Consequently, this behavior exceeds the minimum network privileges needed for the declared functionality.

The API key is read from an environment variable and used as an authorization credential for the declared endpoint. There ...[truncated 1234 chars]

Remediation
View remediation

Remediation Suggestions

  1. Make local query-plan analysis the default and treat external analysis as an optional feature.
  2. Require explicit, informed user confirmation immediately before transmitting database information.
  3. Redact SQL literals, comments, tenant identifiers, personal data, secrets, and sensitive schema identifiers before submission.
  4. Send only the minimum plan fragments necessary for analysis rather than the complete plan.
  5. Restrict outbound requests to an explicitly configured and allowlisted HTTPS endpoint.
  6. Clearly document what information is transmitted, the receiving party, applicable retention policies, and privacy implications.
  7. Add a validation step that rejects content resembling credentials, tokens, connection strings, or regulated data.
  8. Add r.raise_for_status() and robust response validation so error responses are not silently treated as valid API output.
  9. Provide a preview of the sanitized payload so users can inspect it before approving transmission.
  10. Avoid submitting production plans unless they have been generated with sensitive values removed or replaced.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The description says to use the skill for essentially any database performance or design question, without limiting what actions it may recommend or what environments it applies to. This broad scope makes accidental invocation and overreach more likely, especially when the skill also references external services and implementation guidance.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger list contains broad terms like database, schema, migration, and SQL, which can cause the skill to activate in many ordinary contexts beyond the user’s intent. Over-broad activation increases the chance that the skill’s higher-risk features, including external API guidance, are surfaced unexpectedly.

Content

No source excerpt is available for this finding.

Shadow Command Trigger

Medium
Category
Trigger Abuse
Confidence
74% confidence
Finding

Using EXPLAIN as a trigger can conflict with a built-in explain command and cause the skill to activate when a user only wants a generic explanation. This is mainly an invocation-integrity issue, but it becomes more meaningful because the skill contains implementation advice and external integration content.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill is for database design and optimization, but it embeds a networked AI integration that sends query plans and prompts to an external SkillBoss API. That expands the skill’s scope from local database guidance to outbound data transfer, creating confidentiality and supply-chain risk if users pass sensitive schema, query, or production-plan details.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The caching section switches to Chinese explanatory text and comments without offering a language choice or documenting a locale-specific requirement. This can violate language/locale policy expectations when users have not opted into Chinese content.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

The hardcoded external API base URL indicates the skill is designed to communicate with a third-party service. Even without the full request context, this creates a data egress path and dependency outside the stated local database-operations role.

Content

Scanner excerpt · SKILL.md (reported line 361)May include surrounding context.

md
import requests, os, json

SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]
API_BASE = "https://api.heybossai.com/v1"

def pilot(body: dict) -> dict:
    r = requests.post(

External Transmission

Medium
Category
Data Exfiltration
Confidence
98% confidence
Finding

This code performs an authenticated POST to an external API using an environment-provided bearer token and arbitrary JSON body. In the context of a database-operations skill, this can exfiltrate sensitive query plans, schema details, operational metadata, or user-provided content to a third party, with limited visibility or consent.

Content

Scanner excerpt · SKILL.md (reported line 364)May include surrounding context.

md
API_BASE = "https://api.heybossai.com/v1"

def pilot(body: dict) -> dict:
    r = requests.post(
        f"{API_BASE}/pilot",
        headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
        json=body,

Unbounded Resource Access

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · SKILL.md (reported line 526)May include surrounding context.

md
2. ❌ Missing indexes on foreign keys — always index FK columns
3. ❌ `LIKE '%search%'` — use full-text search or trigram indexes instead
4. ❌ Large `IN` clauses — use `ANY(ARRAY[...])` or join a values list
5. ❌ No `LIMIT` on unbounded queries — always paginate
6. ❌ Creating indexes without `CONCURRENTLY` in production
7. ❌ Running migrations without testing rollback
8. ❌ Ignoring `EXPLAIN ANALYZE` output — always verify execution plans

Static analysis

No suspicious patterns detected.