Security audit

Dbt Model Auditor

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate dbt audit skill, but it can read sensitive database profile configuration without clear opt-in or redaction.

Review this skill before installing if your dbt projects may include local `profiles.yml` files. Use it only with redacted profile data or after confirming the agent will not print or summarize credentials, tokens, hosts, private key paths, or other sensitive connection details.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:49
Finding: Unnecessary Exposure of Database Credentials Through Full profiles.yml Read
Content: View full analysis
/dev/null ``` ### Technical Analysis The Skill directs the agent to print the complete `profiles.yml` file when inspecting a dbt project. This file can contain sensitive data-warehouse connection information, including usernames, passwords, access tokens, private-key paths, account identifiers, hostnames, and database or schema details. Most of the documented audit checks require only limited metadata, such as the dbt adapter type, target name, or thread count. Reading the entire profile therefore exceeds the access necessary for the declared auditing purpose. Once printed, sensitive values may enter the agent context, execution logs, conversation transcripts, or generated reports. The command suppresses errors but does not filter, redact, or restrict sensitive fields. Although the reviewed Skill contains no instruction to transmit the data externally, its unnecessary ingestion creates a credential-exposure risk. ### Attack Path 1. A user invokes the Skill in a dbt project containing a local `profiles.yml`. 2. The agent follows the documented discovery procedure and executes `cat profiles.yml`. 3. The complete file is loaded into the agent-visible context. 4. Any plaintext or resolved credentials in the file become accessible to the active agent session and potentially to associated logging or transcript systems. 5. The sensitive values may subsequently be reproduced in an audit report, diagnostic output, or another tool invocation. 6. If exposed to an unauthorized party, valid credentials could be used to access the associated data warehouse within the permissions granted to that account. No automatic external exfiltration or credential use was identified in the reviewed ...[truncated 817 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The trigger list includes broad phrases such as "dbt model" and "dbt documentation," which are likely to match many ordinary user requests beyond a focused audit use case. Overly broad activation can cause the skill to run in unintended contexts, increasing the chance it reads local project files and sensitive configuration such as dbt metadata when the user did not clearly request that level of access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill explicitly instructs the agent to read profiles.yml, which often contains sensitive environment details such as account identifiers, usernames, hosts, schemas, and sometimes embedded secrets, yet the description provides no warning or consent boundary. In a broad-trigger skill, this makes unintended sensitive file access more likely and can expose configuration data unnecessarily during a routine audit.
Content: No source excerpt is available for this finding.