T09 · Insecure Skill Coding Practices
Error
- Location
scripts/schema.sh:160- Finding
SQL Injection Through Unsanitized Table Identifiers
- Content
View full analysis
- Remediation
View remediation
Security audit
Schema Builder
Security checks for vulnerabilities and agentic risk
Overview
This database schema skill is mostly purpose-related, but it includes under-disclosed generators that can produce unsafe SQL and hardcoded administrator seed credentials.
Review this skill before installing. It does not show exfiltration or system compromise behavior, but its richer schema generator is under-disclosed and can emit SQL or seed data that should not be executed against staging or production databases without validation and manual review.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/schema.sh:208- Finding
Predictable Unsalted Password Hashes in Generated Seed Data
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Rogue AgentSelf-Modification, Session Persistence
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description partially matches the code: it does build database schemas, generate SQL, and show relationship models/ER diagrams. However, the implementation materially extends beyond that purpose. It also generates migration scripts, seed data, optimization advice, NoSQL schemas, and a schema comparison helper. These are substantive extra capabilities rather than minor implementation details. There is no evidence of unrelated external access or hidden side effects; the mismatch is due to undeclared functionality breadth rather than malicious behavior.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
createbash scripts/script.sh create <table cols>alter
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest describes this skill as building database schemas with SQL generation and relationship modeling, which implies SQL-oriented schema design. The
nosqlcommand expands the skill into MongoDB document-schema generation, a materially different capability not reflected in the manifest description.- Content
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 80% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
sh DATA_DIR="$HOME/.local/share/schema-builder" mkdir -p "$DATA_DIR" # # # #