DuckDB CLI skills

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 5:16 AM UTC
• Version: 1.0.0

Overview

This is a Markdown-only DuckDB CLI reference skill whose file access, data conversion, and configuration examples are disclosed and aligned with its purpose.

Install this only if you want an agent to help with DuckDB CLI workflows. Treat generated DuckDB commands as capable of reading local data files and writing or modifying outputs; use read-only mode for inspection, verify paths before exports, and only change ~/.duckdbrc or use .edit when you explicitly want persistent configuration or an external editor.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Skill Enumeration

Medium

• Category: Agent Snooping

Content

Copy `SKILL.md` to your Claude Code skills directory:

```bash
mkdir -p ~/.claude/skills/duckdb
cp SKILL.md ~/.claude/skills/duckdb/
```

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Session Persistence

Medium

• Category: Rogue Agent

Content

Copy `SKILL.md` to your Claude Code skills directory:

```bash
mkdir -p ~/.claude/skills/duckdb
cp SKILL.md ~/.claude/skills/duckdb/
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Vague Triggers

Medium

• Confidence: 98% confidence
• Finding: The trigger phrases are broad enough to match many generic requests involving SQL, queries, parquet, or data analysis, which can cause the skill to activate outside narrowly intended DuckDB tasks. Overbroad activation increases the chance an agent routes unrelated or sensitive workflows into a tool that can read files, write files, and modify databases.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill includes commands that write files, create tables, insert data, and export results without prominent warnings that these operations mutate data or overwrite outputs. In an agent context, this can lead to unintended data modification or destructive side effects when users expect read-only analysis.

Session Persistence

Medium

• Category: Rogue Agent

Content

# Pipe to another command
duckdb -csv -c "SELECT * FROM 'data.parquet'" | head -20

# Write to stdout
duckdb -c "COPY (SELECT * FROM 'data.csv') TO '/dev/stdout' (FORMAT CSV)"
```

• Confidence: 62% confidence
• Finding: The configuration guidance encourages persistent settings in `~/.duckdbrc`, which creates cross-session behavior that can affect future runs in ways users or agents may not expect. While common for CLI tools, persistence can weaken reproducibility and may introduce risk if unsafe defaults or output behaviors are stored and later applied automatically.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The documentation presents a 'Safe Mode' with strong security guarantees while elsewhere advertising features like `.edit` that invoke an external editor selected from environment variables. That mismatch can cause users or an agent to assume a session is constrained when external program execution paths may still exist outside that mode or may not be clearly scoped, increasing the risk of unsafe tool use based on misleading documentation.

Natural-Language Policy Violations

Low

• Confidence: 72% confidence
• Finding: The skill name "duckdb-en" suggests an English-specific variant, but the file does not explain the locale restriction or offer users an explicit language choice. This can indicate a language policy constraint that is undocumented from the user's perspective.

Static analysis

No suspicious patterns detected.