Security audit

Database Replication Advisor

Security checks for vulnerabilities and agentic risk

Overview

This is a plausible database replication advisor, but it includes live database and cloud failover commands that could disrupt production without strong safeguards.

Install only if you treat this as an operator-reviewed runbook, not an autonomous execution skill. Before using it, restrict credentials to least privilege, run assessment probes in non-production or with explicit approval, avoid command-line database passwords, and require change-management approval before any failover, promotion, rewind, or AWS RDS failover command.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:59
Finding: Environment Variables Injected Directly into Executable Python Source
Content: View full analysis
read_ts else 0 print(f'Application-level replication lag: {lag:.3f}s') print(f'Assessment: {\"HEALTHY\" if lag < 1 else \"WARNING\" if lag < 10 else \"CRITICAL\"}') " ``` ### Technical Analysis The shell expands `PRIMARY_HOST`, `REPLICA_HOST`, `DB_NAME`, and `DB_USER` directly inside Python string literals before passing the resulting source to `python3 -c`. These values are treated as executable source text rather than as data. If an attacker can influence one of these environment variables, a single quote can terminate the intended Python literal. Additional Python expressions or statements can then be introduced. Because the generated source is executed by `python3`, successful exploitation can run arbitrary local commands with the privileges of the user executing the Skill. This behavior is unnecessary for replication assessment. Python can safely read ...[truncated 1441 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:95
Finding: Database Values Interpolated Directly into SQL Statements
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:31
Finding: MySQL Password Exposed Through Command-Line Arguments
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The failover-test workflow goes beyond advisory analysis and includes commands that can alter database roles, stop writes, promote standbys, trigger AWS failover, and rebuild nodes. If an agent executes this in a real environment without strict gating, it can cause service disruption, data divergence, or unintended operational changes.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The failover instructions contain disruptive operations such as read-only changes, promotion, cluster failover, and rewinding nodes, yet they are not fronted by strong warnings or execution safeguards. In a production context, that makes accidental outage or data-loss scenarios much more likely, especially when followed by an autonomous agent.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Including aws rds failover-db-cluster grants infrastructure control that can directly change production database topology. For a replication advisory skill, this is overly privileged and expands blast radius from analysis into active cloud control, making accidental or unauthorized failover materially more dangerous.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 370)May include surrounding context.
md
# Should return: t (true = standby) # Check application connectivity curl -s "$APP_HEALTH_ENDPOINT" | python3 -c " import sys, json data = json.load(sys.stdin) db_status = data.get('database', {}).get('status', 'unknown')

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The assess command is presented as a health check, but its application-level heartbeat probe creates a table and writes to the primary database. That violates the principle of least surprise for a read-only diagnostic action and can modify production state, trigger audit/compliance issues, or fail in restricted environments.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The markdown presents database-writing validation steps as routine assessment without a prominent warning that they modify state. In practice, users or agents may assume the procedure is safe for production diagnostics and execute it without understanding the side effects.
Content: No source excerpt is available for this finding.