Security audit

kettle-sql-extractor

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its Kettle SQL extraction purpose, but it needs review because generated executable SQL, HTML reports, and cleanup commands can be unsafe with untrusted input or broad directories.

Install only if you are comfortable reviewing generated SQL before database execution, especially when Kettle files may come from other people. Avoid running the broad cleanup command from a repository, home directory, or shared workspace; use an explicit output directory and inspect candidates first. Treat generated HTML reports as untrusted when processing untrusted filenames or jobs, and use an isolated Python environment with reviewed, pinned dependencies.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/merge_kettle_sql.py:278
Finding: SQL Injection Through Untrusted Kettle Step Names
Content: View full analysis
Remediation: View remediation
list[str]: normalized = value.replace('\r\n', '\n').replace('\r', '\n') return [f"-- {line}" for line in normalized.split('\n')] ``` For stronger protection, reject multiline metadata entirely before generating executable artifacts. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/batch_extract_kettle_sql.py:522
Finding: Stored HTML Injection in Generated Batch Reports
Content: View full analysis
{table}' for table in sorted(self.batch_summary['unique_tables'])])} ``` ```python {"".join([ f'
' f'
{file["file_name"]} - {file["status"]}
' f'
SQL components: {len(file["sql_components"]) if "sql_components" in file else 0}
' f'{"
Output path: " + file.get("output_path", "") + "
" if file.get("output_path") else ""}' f'{"
Error: " + file["error"] + "
" if file.get("error") else ""}' f'
' for file in self.batch_summary['file_summaries'] ])} ``` ### Technical Analysis The HTML report is assembled through direct string interpolation. Dynamic values such as filenames, output paths, and error messages are inserted without HTML escaping. A filename is attacker-controlled on supported filesystems and may contain HTML metacharacters. When such a filename is included in the report, the browser interprets it as markup rather than plain text. The same unsafe pattern affects output paths and error messages. Although table extraction uses restrictive regular expressions in the current implementation, it is still unsafe to insert those values without encoding and the code may become exploitable through that field if parsing rules are expanded. ### Attack Path 1. An attacker supplies a Kettle file whose filename contains HTML markup or an event-handler payload. 2. The user runs `batch_extract_kettle_sql.py`. 3. The filename is stored in `file_summaries`. 4. `generate_html_report()` interpolates the filename directly into `batch_report.html`. 5. The user opens the generated report, as recommended by the project documentation. 6. The browser parses the injected markup and may ...[truncated 648 chars]
Remediation: View remediation
`, `"`, `'`, `&`, and event-handler markup. 6. Avoid displaying raw exception text when a fixed, non-sensitive error description is sufficient. Example: ```python from html import escape safe_name = escape(str(file["file_name"]), quote=True) safe_status = escape(str(file["status"]), quote=True) safe_path = escape(str(file.get("output_path", "")), quote=True) safe_error = escape(str(file.get("error", "")), quote=True) ``` ]]>

T08 · Insecure Dependencies

Warning

Location: SKILL.md:327
Finding: Unpinned and Unnecessary Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:411
Finding: Overbroad Recursive Cleanup Can Delete Unrelated Directories
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (57)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明的核心功能是解析 Kettle 作业文件并提取 SQL，但提供的代码完全没有处理 Kettle 文件、SQL 内容或相关数据流。相反，它只对一个技能包的文件与目录结构进行静态检查，并输出验证结果。这属于与声明目的 materially different 的主要用途，且缺失声明中的关键能力，因此应判定为明显不匹配。
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.
md
**解决方案**：使用 `batch_extract_kettle_sql.py` 工具

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 212)May include surrounding context.
md
**解决方案**：使用 `batch_extract_kettle_sql.py` 工具

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 217)May include surrounding context.
md
**解决方案**：使用 `batch_extract_kettle_sql.py` 工具

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 220)May include surrounding context.
md
**解决方案**：使用 `batch_extract_kettle_sql.py` 工具

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 225)May include surrounding context.
md
**解决方案**：使用 `batch_extract_kettle_sql.py` 工具

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 228)May include surrounding context.
md
**解决方案**：使用 `batch_extract_kettle_sql.py` 工具

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 347)May include surrounding context.
md
**解决方案**：使用 `batch_extract_kettle_sql.py` 工具

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 379)May include surrounding context.
md
**解决方案**：使用 `batch_extract_kettle_sql.py` 工具

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 187)May include surrounding context.
md
### 1. **scripts/merge_kettle_sql.py**（核心合并工具）

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 192)May include surrounding context.
md
### 1. **scripts/merge_kettle_sql.py**（核心合并工具）

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 195)May include surrounding context.
md
### 1. **scripts/merge_kettle_sql.py**（核心合并工具）

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 198)May include surrounding context.
md
### 1. **scripts/merge_kettle_sql.py**（核心合并工具）

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 201)May include surrounding context.
md
### 1. **scripts/merge_kettle_sql.py**（核心合并工具）

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 204)May include surrounding context.
md
### 1. **scripts/merge_kettle_sql.py**（核心合并工具）

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 337)May include surrounding context.
md
### 1. **scripts/merge_kettle_sql.py**（核心合并工具）

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 354)May include surrounding context.
md
### 1. **scripts/merge_kettle_sql.py**（核心合并工具）

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 376)May include surrounding context.
md
### 1. **scripts/merge_kettle_sql.py**（核心合并工具）

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 391)May include surrounding context.
md
### 1. **scripts/merge_kettle_sql.py**（核心合并工具）

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 397)May include surrounding context.
md
### 1. **scripts/merge_kettle_sql.py**（核心合并工具）

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 403)May include surrounding context.
md
### 1. **scripts/merge_kettle_sql.py**（核心合并工具）

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 423)May include surrounding context.
md
### 1. **scripts/merge_kettle_sql.py**（核心合并工具）

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 466)May include surrounding context.
md
### 1. **scripts/merge_kettle_sql.py**（核心合并工具）

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 470)May include surrounding context.
md
### 1. **scripts/merge_kettle_sql.py**（核心合并工具）

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · docs/USAGE_EXAMPLES.md (reported line 321)May include surrounding context.
只生成HTML报告

python batch_extract_kettle_sql.py --dir /path/to/kettle/jobs --output compact_output rm compact_output/batch_*/all_extracted_sql.txt 2>/dev/null || true

text
## 性能优化建议

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

{file["file_name"]} - {file["status"]}

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

SkillSpector

Tp4

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Tool Parameter Abuse

只生成HTML报告