T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/read_tables.py:104- Finding
Undisclosed Exfiltration of Sampled Database Records
- Content
View full analysis
- Remediation
View remediation
Security audit
TEXT2SQL
Security checks for vulnerabilities and agentic risk
Overview
This skill is for Text-to-SQL setup, but it can collect and upload much more database or Excel data than the instructions clearly disclose.
Review before installing, especially if you would connect it to production databases or sensitive spreadsheets. Use only a least-privilege read-only database account, avoid real secrets in command-line arguments, inspect or restrict what is sent to asksql.ai, and do not provide Excel workbooks containing confidential data unless you accept full remote processing of the file.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (6)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/read_tables.py:339- Finding
Entire Excel Workbook Uploaded to an External Service Without Explicit Consent
- Content
View full analysis
- Remediation
View remediation
T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:327- Finding
False Local-Only Processing Claim Conceals External Data Transmission
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/config_db.py:27- Finding
Database Credentials Stored and Logged in Plaintext
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate_yaml.py:148- Finding
Path Traversal and Arbitrary YAML File Overwrite Through Topic Name
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/read_tables.py:103- Finding
SQL Injection Through Unescaped Database Identifiers
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (21)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared purpose frames the skill as natural-language SQL generation and topic configuration, but the documented behavior goes further by reading local credential files, connecting to live databases, enumerating schemas, processing Excel files, writing artifacts locally, and transmitting database-derived configuration to an external service. That mismatch is dangerous because users may consent to a seemingly narrow function without understanding the full data-access and exfiltration surface.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill instructs sending the user's question and a YAML configuration file to an external HTTP API, but does not present a clear warning about what data may be included or how it will be handled. Because the YAML is derived from database structure and business semantics, this can leak sensitive schema, metadata, and potentially proprietary context to a third party.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The documentation tells the agent to collect and store database URLs and passwords in a local configuration file without prominent warnings or secure-handling guidance. Storing credentials on disk in this way increases the risk of credential theft, accidental disclosure, reuse attacks, and lateral movement if the local environment is compromised.
- Content
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md ### Optional Branches - When user wants to modify topic configuration: Re-call `generate_yaml.py` to overwrite original configuration file - When user wants to reconfigure database: Re-call `config_db.py` to overwrite configuration file - When user wants to view configured topics: Agent lists yaml files in `./output/` directory - When user question is ambiguous and cannot determine topic: Agent actively asks user or lists all topics for selection
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The database URL is printed to stdout and later written into output JSON, which may expose embedded usernames, passwords, hosts, and database names. These credentials can be harvested from logs, terminal history, CI output, or generated artifacts and used for unauthorized database access.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script does not limit itself to schema introspection: it queries live tables, samples up to 2000 rows, and stores per-column sample values and counts. In a text-to-SQL setup context, this can expose sensitive production data and materially exceeds the documented purpose of reading table names and structures.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script writes enriched column information containing sample values to JSON and also sends database-derived content to an external API without an explicit warning or consent flow. This can leak sensitive records locally and remotely, especially if run against production databases.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script transmits database-derived metadata and sampled content to a third-party internet service at asksql.ai. This is dangerous because schema details, comments, and sampled values may contain secrets, PII, or proprietary business information, and the manifest description does not clearly disclose external data transfer.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill declares capabilities to read/write local files and access the network, but does not constrain those abilities with explicit tool-scope metadata. In a skill that handles database credentials, local configuration, and remote API calls, missing permission boundaries increases the chance of over-broad agent actions and unintended data exposure.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The trigger language is broad enough to activate the skill for many generic requests involving databases, SQL, or data questions. Over-broad triggering is risky here because the skill can read local files, inspect databases, and call an external API, so accidental invocation could lead to unnecessary access or disclosure.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger conditions do not clearly limit when the skill should engage, despite the skill supporting sensitive operations like credential handling, schema enumeration, and external transmission. Ambiguous scope makes it easier for the agent to overreach into actions the user did not specifically intend.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
SKILL.md states that after the user provides an Excel file, 'no parsing operation is needed,' yet the very next command runs
read_tables.py --excel-file ..., which necessarily parses or reads the Excel content to extract table structure. This is an active contradiction in the operational guidance, not merely an omitted detail.- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The document repeatedly says the agent is 'strictly prohibited' from selecting tables or making assumptions for topic setup, emphasizing user-controlled selection. Later, it instructs the agent to analyze the user's question and select the most relevant topic, which conflicts with the earlier strict non-selection/non-assumption guidance about agent autonomy in configuration decisions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The notes acknowledge that database URLs and passwords are saved locally, but only as an implementation detail rather than a proactive user warning before use. In this context, delayed disclosure is dangerous because users may provide highly sensitive credentials without informed consent about storage behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script persists the database password in plaintext JSON on local disk, which exposes credentials to any local user, backup system, log/archive process, or accidental source-control inclusion that can read the file. In this skill context, the risk is heightened because the tool is specifically meant to configure database access, so it is likely to handle real production credentials and normalize insecure secret storage.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script reads a local YAML configuration file and sends its full contents together with the user's natural-language question to a remote service. That creates a real data-exfiltration risk because configuration files may contain schema details, connection metadata, business context, or secrets, and the code provides no consent prompt, redaction, or restriction on what can be uploaded.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The top-level documentation claims the script reads table names and structures, but the implementation also samples row data and sends information to a remote API. This mismatch undermines informed consent and can cause operators to run the tool under false assumptions about what data leaves the environment.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The Excel-processing path adds a separate data-ingestion and remote-processing capability that is not clearly scoped by the skill description. That increases attack surface and creates an additional path for sensitive local files to be uploaded to an external service.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The external POST request is a real data egress point from the local environment to a public internet endpoint. In this skill context, that is more dangerous because the payload may include proprietary schema and sampled data from enterprise databases, not just harmless configuration metadata.
- Content
python "db_name": db_name } # print(column_info) response = requests.post( generate_url, json={"data": column_info, "format": "json"}, timeout=120
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The specification states that field descriptions are 'typically written in the local language for the target domain,' which introduces a language/locale expectation in natural-language guidance. The document does not offer a user choice or clearly justify a mandatory locale constraint, so this can conflict with language-choice policy requirements.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
This code performs a file write operation by creating a YAML file in the specified output path. While the script's purpose is to generate a configuration file, the safety criterion for code files asks for some user disclosure such as a confirmation prompt, user-facing log, print, docstring, or comment explaining the action; the visible disclosure occurs only after the write completes, not before or at the operation itself.
- Content
Static analysis
No suspicious patterns detected.