SQL to BI Builder

• Outcome: Review
• Latest audit: Sep 11, 2026 · 8:29 PM UTC
• Version: 1.2.0

Overview

The skill mostly does what it claims, but the dashboards it generates have review-worthy browser security risks before use with untrusted SQL or real BI data.

Install only if you are comfortable reviewing generated web assets before sharing or using them with untrusted SQL. Patch or avoid the generated service frontend until HTML injection is fixed, pin or vendor ECharts with integrity checking, restrict CORS before connecting real data, and review any commands that modify ~/.zshrc or install Python packages.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate_service_bundle.py:500

Finding

Stored DOM-Based Cross-Site Scripting Through Dashboard Metadata

Content

View full analysis

${w.title || w.query_id}

${w.chart || 'table'}

`; ``` ### Technical Analysis The SQL Markdown file is an external input. Its headings and `title` metadata can contain arbitrary HTML because the parser does not validate or encode these fields. The resulting value passes through `query_catalog.json` and `dashboard.json`, is returned by the generated backend, and is interpolated directly into `Element.innerHTML`. Unlike `textContent`, `innerHTML` invokes the browser's HTML parser. Event-handler attributes or similar active marku ...[truncated 1724 chars]

Remediation

View remediation

`, ``, and HTML-closing sequences in every Markdown metadata field. ]]>

T03 · Remote Payload Retrieval and Execution

Warning

• Location: scripts/generate_service_bundle.py:187

Finding

Generated Dashboards Retrieve and Execute Unpinned Remote JavaScript

Content

View full analysis

``` ```html ``` The standalone scaffold generator emits the same executable dependency: ```html ``` ### Technical Analysis The generated pages retrieve JavaScript from an external CDN every time the dashboard loads. The dependency uses the floating `@5` major-version selector rather than an exact reviewed release. Therefore, the effective JavaScript payload may change after the Skill itself has been audited. No Subresource Integrity hash is supplied, and no Content Security Policy restricts executable sources. The browser consequently trusts and executes whatever content the remote URL returns. This creates a remote code-execution channel within the browser context. It can be exploited if: - The CDN or its delivery infrastructure is compromised. - The upstream package or publishing account is compromised. - A future release resolving under `@5` introduces malicious or unsafe behavior. - Network or DNS controls in the deployment environment redirect the dependency request. The Google Fonts requests are not executable JavaScript, but they also introduce external availability and privacy dependencies by disclosing client request metadata. ### Attack Path 1. A user ge ...[truncated 1015 chars]

Remediation

View remediation

``` 3. Generate and verify the integrity hash from the exact approved artifact. Update the version and hash only through a reviewed dependency-update process. 4. Add a Content Security Policy that limits scripts to `'self'` and, only if required, the exact approved CDN. 5. Consider vendoring fonts or using system fonts to eliminate unnecessary outbound requests and availability dependencies. 6. Maintain a dependency inventory and periodically scan the exact vendored or pinned versions for known vulnerabilities. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/generate_service_bundle.py:24

Finding

Generated Local Backend Uses Overly Permissive CORS Configuration

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill includes virtualenv creation, dependency installation, and command-line environment handling despite being presented as a content-transformation utility. Installing dependencies and modifying the runtime environment materially expand risk because they can execute package install hooks, alter local state, and introduce supply-chain exposure not implied by the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill includes virtualenv creation, dependency installation, and command-line environment handling despite being presented as a content-transformation utility. Installing dependencies and modifying the runtime environment materially expand risk because they can execute package install hooks, alter local state, and introduce supply-chain exposure not implied by the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill includes virtualenv creation, dependency installation, and command-line environment handling despite being presented as a content-transformation utility. Installing dependencies and modifying the runtime environment materially expand risk because they can execute package install hooks, alter local state, and introduce supply-chain exposure not implied by the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill includes virtualenv creation, dependency installation, and command-line environment handling despite being presented as a content-transformation utility. Installing dependencies and modifying the runtime environment materially expand risk because they can execute package install hooks, alter local state, and introduce supply-chain exposure not implied by the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill includes virtualenv creation, dependency installation, and command-line environment handling despite being presented as a content-transformation utility. Installing dependencies and modifying the runtime environment materially expand risk because they can execute package install hooks, alter local state, and introduce supply-chain exposure not implied by the declared purpose.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md

python scripts/generate_ui_scaffold.py --dashboard /abs/path/out/dashboard.json --out /abs/path/out/ui

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill advertises and instructs shell execution, file reads/writes, and service startup, but it does not declare any explicit tool scope or permission boundaries. In an agent setting, this increases the chance that the skill can invoke broader capabilities than a reviewer or orchestrator expects, which weakens least-privilege protections and makes misuse harder to contain.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/install_python311.md (reported line 41)May include surrounding context.

If you are on Intel Mac, the path may be /usr/local/opt/python@3.11/bin.

Create Skill Venv

After python3.11 is ready:

bash

cd /Users/lyg/software/sql2bi/skills/sql-to-bi-builder

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The generated backend startup script creates a virtual environment, installs packages, and executes a shell script. Although this is consistent with a startup script's purpose, this generator file does not clearly warn users that running the produced scripts will modify the environment and execute commands.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This code performs file creation and permission changes in the target output directory, including marking generated scripts executable. While the module docstring states it generates services, there is no user-facing warning, confirmation, or inline disclosure near the write/chmod operations that these filesystem changes will occur.

Content

No source excerpt is available for this finding.

Tainted flow: 'result' from pathlib.Path.read_text (line 764, file read) → pathlib.Path.write_text (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/infer_semantics.py (reported line 771)May include surrounding context.

python

}

    out_path.parent.mkdir(parents=True, exist_ok=True)
    out_path.write_text(json.dumps(result, ensure_ascii=False, indent=2), encoding="utf-8")

    print(f"Inferred semantics for {len(semantic_queries)} queries -> {out_path}")

Tainted flow: 'result' from pathlib.Path.read_text (line 118, file read) → pathlib.Path.write_text (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/parse_sql_md.py (reported line 121)May include surrounding context.

python

result = build_output(queries, in_path)

    out_path.parent.mkdir(parents=True, exist_ok=True)
    out_path.write_text(json.dumps(result, ensure_ascii=False, indent=2), encoding="utf-8")

    print(f"Parsed {len(queries)} SQL blocks -> {out_path}")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/run_pipeline.py (reported line 14)May include surrounding context.

python

def run_step(cmd: list[str]) -> None:
    print("[RUN]", " ".join(cmd))
    subprocess.run(cmd, check=True)


def main() -> None:

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest describes converting SQL markdown into a BI dashboard specification and UI scaffold, but this script also offers an optional --with-services mode to generate a backend/frontend service bundle. Generating service code is broader than query parsing, dashboard spec creation, and UI scaffolding as stated in the skill description.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The skill's stated purpose is to build analytics dashboards, chart pages, and BI interfaces from SQL statements. Creating a services bundle introduces an additional capability—application/service generation—that is not an obvious requirement of producing a dashboard specification and UI scaffold.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This markdown file instructs the user to append exports and initialization commands to ~/.zshrc and immediately source the file. That changes persistent shell configuration, but the document does not explicitly warn the user that it will modify their login environment or suggest reviewing existing config first.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The Homebrew option appends a new PATH export to ~/.zshrc and reloads the shell, which affects future terminal sessions. The instructions do not disclose that this is a persistent configuration change or caution the user to verify the path for their system.

Content

No source excerpt is available for this finding.