ClawHub
Back to skill

Security audit

Zero TiDB(Deprecated)

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward TiDB Cloud Zero quickstart skill with no hidden code, but users should protect the temporary database credentials it generates.

Install only if you intend to let the agent create temporary TiDB Cloud Zero databases. Treat the returned connection details as secrets: avoid committing response files, use restrictive file permissions, delete them when done, and prefer safer MySQL credential handling over putting passwords directly in commands.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:19
Finding

Database credentials stored in a plaintext file without enforced access controls

Content
View full analysis
Remediation
View remediation
"$response_file" ``` - Register cleanup with `trap` and remove the file as soon as it is no longer required: ```bash trap 'rm -f -- "$response_file"' EXIT ``` - Do not use a predictable filename in a shared temporary directory. - Add credential-response filenames to `.gitignore` and prevent their collection as CI artifacts. - Avoid backups and logging of the response file. - Prefer extracting required values in memory or passing them through a protected secret-management mechanism. - Clearly document that the response is a secret and should be deleted when the instance expires. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:24
Finding

Database passwords exposed through command-line arguments

Content
View full analysis
with step 2 output) mysql "" -e "SELECT 1 AS health_check, 2 AS example_value;" ``` The document also provides this password-bearing CLI command: ```bash mysql --connect-timeout=10 --protocol=TCP -h '' -P 4000 -u '' -p'' ``` ### Technical Analysis Both examples instruct the user to place credentials directly in command-line arguments. The connection URI contains the username and password, while the second command explicitly supplies the password using `-p''`. Command arguments can be exposed through process-inspection interfaces and operational monitoring tools. They may also be retained in shell history, terminal recordings, debugging output, CI logs, audit telemetry, or copied command transcripts. Quoting a secret protects shell parsing but does not hide it from the process argument vector. Although some operating systems restrict access to other users' process information, the examples cannot safely assume those restrictions. MySQL clients also commonly warn that supplying a password on the command line is insecure. ### Attack Path 1. A user replaces the placeholders with active TiDB connection credentials and executes the documented command. 2. The shell records the command in history, or the operating system exposes the command's argument vector while the client is running. 3. A local user, monitoring agent, CI log reader, support operator, or process with access to the history or telemetry captures the password or full connection URI. 4. The attacker uses the recovered credentials to connect to the ephemeral da ...[truncated 578 chars]
Remediation
View remediation
"$defaults_file" <<'EOF' [client] host= port=4000 user= password= protocol=TCP ssl-mode=VERIFY_IDENTITY EOF mysql --defaults-extra-file="$defaults_file" \ -e "SELECT 1 AS health_check, 2 AS example_value;" ``` - Alternatively, omit the password value after `-p` so that the client prompts for it interactively: ```bash mysql --connect-timeout=10 --protocol=TCP \ -h '' -P 4000 -u '' -p ``` - Use an approved credential helper or secret manager for automated workflows. - Disable shell tracing around credential handling and ensure CI systems mask secret values. - Avoid printing the complete `connectionString`; redact its password before displaying or logging it. - Delete temporary credential files immediately after use and enforce mode `0600`. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

bash
# 1) Provision instance
curl -s -X POST https://zero.tidbapi.com/v1alpha1/instances \
  -H "Content-Type: application/json" \
  -d '{"tag":"sql-smoke-test"}' \
  | tee tidb-zero.json

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

Quick Start

bash
curl -X POST https://zero.tidbapi.com/v1alpha1/instances \
  -H "Content-Type: application/json" \
  -d '{
    "tag": "agent-run"

Static analysis

No suspicious patterns detected.