ClawHub
Back to skill

Security audit

db-bridge

Security checks for vulnerabilities and agentic risk

Overview

This skill is a database bridge with no hidden bundled code, but it directs agents to run broad SQL read, write, update, and delete commands through an unbundled tool without enough safeguards.

Install only in a controlled environment where sql-linker is trusted, version-pinned, and configured with a least-privileged database account limited to the intended tables. Require explicit approval for INSERT, UPDATE, and DELETE, preview affected rows before mutations, avoid free-form SQL or WHERE clauses from user text, and verify masking and audit logging before using real supplier contact data.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:202
Finding

Raw SQL and Unparameterized Predicates Enable SQL Injection

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 202–219
Vulnerability Type: Raw SQL execution and unparameterized caller-controlled predicates
Risk Level: High

Vulnerable Code

bash
# Query
python scripts/sql_linker.py query  "SELECT * FROM <table> LIMIT 10"
python scripts/sql_linker.py query  "SHOW TABLES"
python scripts/sql_linker.py query  "DESC <table_name>"

# Insert
python scripts/sql_linker.py --user-label "<label>" --session-id "<session_id>" \
  insert "<table>" "{\"field\":\"value\",\"field2\":123}"

# Update
python scripts/sql_linker.py --user-label "<label>" --session-id "<session_id>" \
  update "<table>" "{\"field\":\"new_value\"}" "<where_clause>"

# Delete
python scripts/sql_linker.py --user-label "<label>" --session-id "<session_id>" \
  delete "<table>" "<where_clause>"

The document additionally states at line 243:

text
Parameterized queries: always use `%s` + tuple to prevent SQL injection

However, the CLI examples accept complete SQL queries, table identifiers, and free-form where_clause strings. The documented CLI does not expose a value-binding mechanism for these predicates, so the parameterization claim is inconsistent with the instructed behavior.

Technical Analysis

Table names and SQL predicates are syntactic SQL elements and cannot be made safe merely by placing them in shell quotes. If request content is substituted into these placeholders without strict parsing and validation, an attacker may supply a tautological predicate such as 1=1, add SQL comments, alter predicate logic, or potentially inject additional statements where the database driver permits stacked statements.

UPDATE and DELETE are particularly dangerous because a malicious or empty predicate can expand a targeted operation into a table-wide modification. The same raw query interface can ...[truncated 1410 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the general-purpose raw SQL query interface from Agent-facing instructions.
  • Replace free-form WHERE clauses with structured, typed JSON filters such as field, operator, and value tuples.
  • Validate all table and field identifiers against explicit allowlists loaded from table.json.
  • Permit only a small allowlist of filter operators and reject SQL comments, delimiters, subqueries, unions, and statement separators.
  • Bind every data value through the database driver's parameter API; never concatenate values into SQL.
  • Reject UPDATE and DELETE requests with missing, empty, tautological, or excessively broad predicates.
  • Require confirmation and a preview of the affected row count before destructive operations.
  • Add automated tests for tautologies, comments, stacked statements, malformed identifiers, and predicate-bypass payloads.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:31
Finding

Unrestricted Schema Enumeration and Bulk Reads Violate Least Privilege

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31–38
Vulnerability Type: Excessive database discovery and unrestricted data access
Risk Level: Medium

Vulnerable Code

bash
# Query current table structure
python scripts/sql_linker.py query "SHOW TABLES"
python scripts/sql_linker.py query "DESC <table_name>"
python scripts/sql_linker.py query "SELECT * FROM <table> LIMIT 3"

Additional instructions at line 61 recommend an unbounded read:

bash
python scripts/sql_linker.py query "SELECT * FROM <table>"

Technical Analysis

The declared purpose of the Skill is to bridge tables configured in table.json, which defines only supplier_table. Despite that scope, the instructions use SHOW TABLES, accept arbitrary table names, and issue SELECT * queries. This allows database discovery and access to columns that are not required for the requested task.

The configured supplier table contains contact names, telephone numbers, and email addresses. Returning every column and potentially every row increases the likelihood of unnecessary exposure of personal and business-sensitive information. If the database contains tables not listed in table.json, enumeration also reveals those tables and facilitates subsequent targeting.

No instruction requires row-level authorization, field-level authorization, masking, pagination, a maximum result size, or validation that the selected table appears in table.json.

Attack Path

  1. A user asks the Agent to inspect available database content or frames an unrelated table as necessary for a supplier task.
  2. The Agent follows the recommended workflow and executes SHOW TABLES.
  3. The Agent uses DESC to enumerate columns in a selected table.
  4. The Agent executes SELECT * against that table, potentially without a row limit.
  5. Database contents, including personal or business-sensitive fields, are returned through ...[truncated 564 chars]
Remediation
View remediation

Remediation Suggestions

  • Derive the available table list exclusively from table.json; do not execute SHOW TABLES.
  • Reject every table and field not explicitly declared in the local configuration.
  • Replace SELECT * with an explicit minimum-required column list.
  • Apply mandatory pagination and a strict server-side maximum row count.
  • Enforce row-level and column-level authorization before issuing any query.
  • Mask contact details by default and reveal them only when the authenticated user's role and task require access.
  • Require explicit authorization for schema inspection and record denied attempts in the audit log.
  • Use a database account restricted to only the configured tables and necessary operations.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:225
Finding

Security-Critical Operations Depend on an Absent and Unverifiable External Component

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 225–248
Vulnerability Type: Unverifiable security dependency and fail-open documentation
Risk Level: Medium

Vulnerable Code

text
Actual permissions governed by sql-linker's read_only config and business rules.

Security Principles

1. Field whitelist: only fields defined in table.json are writable

2. Parameterized queries: always use %s + tuple to prevent SQL injection

3. Audit log: sql-linker automatically records operator, IP, and SQL

4. Sensitive field masking: rules controlled by sql-linker's mask_values config

The Skill repeatedly invokes the external component as follows:

bash
python scripts/sql_linker.py query "SHOW TABLES"

However, the audited project contains only SKILL.md and table.json; scripts/sql_linker.py is not included.

Technical Analysis

Authorization, query parameterization, field allowlisting, masking, audit logging, and database connectivity are delegated to an external script whose implementation and provenance cannot be inspected. Consequently, none of the stated controls can be confirmed from the supplied package.

The Skill presents these protections as guarantees while instructing the Agent to pass raw SQL, write requests, and identity/session metadata to the external executable. If a different, outdated, compromised, or incorrectly configured script is resolved at that path, it may omit the documented checks or process the supplied metadata and database operations unsafely.

This is a trust-boundary weakness rather than evidence that the absent script is itself malicious. The risk results from making security-critical behavior dependent on an unpinned and unaudited component.

Attack Path

  1. The Skill is installed in an environment containing an unreviewed or incorrectly configured scripts/sql_linker.py.
  2. The Agent follows the documentation and invokes that script with SQL o ...[truncated 996 chars]
Remediation
View remediation

Remediation Suggestions

  • Include the security-critical linker implementation in the reviewed package or declare a cryptographically pinned, versioned dependency.
  • Verify the component's integrity before execution and fail closed when the expected version or signature is unavailable.
  • Define and enforce a narrow structured API instead of passing raw SQL to an external executable.
  • Ensure authorization, table allowlisting, parameter binding, masking, and audit logging are mandatory rather than optional configuration.
  • Run the linker with a least-privileged database account and restricted filesystem and network permissions.
  • Avoid claiming that a control is guaranteed unless the Skill verifies that the control is enabled.
  • Add integration tests that confirm denied writes, rejected unknown fields, masked sensitive values, authentic audit attribution, and rejection of injected predicates.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly instructs the agent to perform INSERT, UPDATE, and DELETE operations directly via CLI, but it does not present a prominent user-facing warning, confirmation requirement, or safety gate for destructive actions. In an agent setting, this increases the risk of unintended data modification or deletion from misunderstood prompts, automation mistakes, or over-broad execution, especially because the workflow emphasizes speed and 'run known commands directly' before consulting documentation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This JSON manifest/config contains human-readable comments entirely in Chinese, such as table and field descriptions, while also using English schema keys. Under the policy, forcing a specific language without user opt-in or documented justification is a natural-language locale violation because consumers of the skill metadata are not given a language choice.

Content

No source excerpt is available for this finding.