ClawHub
Back to skill

Security audit

PostgreSQL Database

Security checks for vulnerabilities and agentic risk

Overview

This is a legitimate PostgreSQL administration skill, but it gives an agent broad database credential and raw SQL authority without built-in safety limits.

Install only if you intentionally want an agent to operate PostgreSQL. Use a least-privileged or read-only database user by default, keep .env and ~/.pgpass private, run scripts only from trusted directories, and manually approve any UPDATE, DELETE, DDL, restore, bulk export, or backup-retention action.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Credential Access

High
Category
Privilege Escalation
Content
set -e

# 加载环境变量
if [ -f .env ]; then
    source .env
fi
Confidence
95% confidence
Finding
The script executes 'source .env', which causes the shell to run any commands contained in that file, not just read credentials. If an attacker can modify .env or influence the working directory, they can achieve arbitrary code execution when the backup script runs, which is especially dangerous because backup jobs often run with elevated privileges and access to sensitive databases.

Credential Access

High
Category
Privilege Escalation
Content
# 加载环境变量
if [ -f .env ]; then
    source .env
fi

# 默认值
Confidence
93% confidence
Finding
The .env loading logic implicitly trusts a local file in the current directory for database secrets and configuration. In practice this creates a credential-access and code-execution risk because secrets may be exposed through weak file protections, and any shell content in .env will be executed by 'source'.

Static analysis

No suspicious patterns detected.