sql-linker-cli

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:51 AM UTC
• Version: 2.0.3

Overview

This database skill is mostly purpose-aligned, but it has serious credential, cloud-audit, and SQL-control weaknesses that users should review before installing.

Install only after treating this as an administrative database tool with production-impacting authority. Use a least-privilege database account, keep read_only enabled unless writes are intended, enable require_explicit_credential_approval, do not run config or CRUD commands where output is logged, verify cloud_audit_url before use, and rotate any cloud API key or database password that may have been printed or stored by this version.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/service_layer/db_bridge.py:618

Finding

Arbitrary SQL execution bypasses table-level access controls

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/service_layer/main.py:256

Finding

The config command discloses the complete cloud API key

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/controller_layer/sql_linker.py:585

Finding

Configurable cloud endpoint can receive API credentials and sensitive audit metadata without origin validation

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/controller_layer/sql_linker.py:479

Finding

Database passwords are protected with weak custom encryption and a locally stored six-character key

Content

View full analysis

str: """Encrypt password using dbpw_key for hybrid encryption.""" import secrets key_padded = (key * 4)[:24] key_bytes = key_padded.encode('utf-8') password_bytes = password.encode('utf-8') iv = secrets.token_bytes(16) encrypted = bytearray() for i, byte in enumerate(password_bytes): key_byte = key_bytes[i % len(key_bytes)] iv_byte = iv[i % len(iv)] encrypted.append(byte ^ key_byte ^ iv_byte) hmac_tag = hmac.new(key_bytes, iv + bytes(encrypted), hashlib.sha256).digest()[:16] combined = iv + bytes(encrypted) + hmac_tag return base64.b64encode(combined).decode('utf-8') def _decrypt_password(self, encrypted_pw: str, key: str) -> str: """Decrypt password using dbpw_key.""" try: key_padded = (key * 4)[:24] key_bytes = key_padded.encode('utf-8') combined = base64.b64decode(encrypted_pw.encode('utf-8')) if len(combined) < 32: raise ValueError("Invalid encrypted data format") iv = combined[:16] encrypted = combined[16:-16] stored_hmac = combined[-16:] expected_hmac = hmac.new(key_bytes, iv + encrypted, hashlib.sha256).digest()[:16] if not hmac.compare_digest(stored_hmac, expected_hmac): raise ValueError("HMAC verification failed - wrong dbpw_key or corrupted data") decrypted = bytearray() for i, byte in enumerate(encrypted): key_byte = key_bytes[i % len(key_bytes)] iv_byte = iv[i % len(iv)] decrypted.append(byte ^ key_byte ^ iv_byte) return bytes(decrypted).decode('utf-8') ...[truncated 2691 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/service_layer/main.py:84

Finding

Database values and query parameters are logged to standard output without redaction

Content

View full analysis

100 else ''}") if params: print(f"[Params] {params}") ``` ```python # Insert command print(f"\n[Insert] {args.table}") print(f"[Data] {data}") ``` ```python # Update command print(f"\n[Update] {args.table}") print(f"[Data] {data}") print(f"[Where] {args.where}") if params: print(f"[Params] {params}") ``` ```python # Delete command print(f"\n[Delete] {args.table}") print(f"[Where] {args.where}") if params: print(f"[Params] {params}") ``` ### Technical Analysis The CLI prints complete data dictionaries, parameter tuples, and WHERE clauses before execution. These values may contain passwords, API tokens, personal data, financial data, authentication identifiers, or other protected records. This behavior undermines the masking applied to SQL audit records because the original values are independently exposed through standard output. CLI output may be retained by Agent conversations, CI systems, terminal recorders, remote administration tools, or support logs. ### Attack Path 1. Run an insert, update, query, or delete operation containing sensitive values. 2. The CLI formats the complete Python dictionary or tuple into standard output. 3. A logging system, terminal recorder, Agent transcript, or another user with log access captures the output. 4. The observer extracts and reuses credentials or accesses disclosed personal or business data. ### Impact Assessment The scope depends on the submitted operation and can include any value processed through the CLI. Potentially exposed information includes: - Database record contents. - Authentication tokens and reset codes. - Email addresses and other personal information. - Internal identifiers. - ...[truncated 226 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This code chunk’s primary purpose is audit logging, not a general SQL CLI. While it is compatible with MySQL/PostgreSQL/SQLite, that support is limited to creating and writing/querying an audit table based on an already-established connection. The declared description promises a much broader tool: CRUD operations, config generation, credential handling, cloud audit synchronization, and approval gating. None of those headline capabilities appear in this code. The chunk also does not use outbound network access, environment read/write, or file read/write despite those being declared. Over-declared permissions alone are not a mismatch, but the absence of the core declared capabilities makes the description materially inaccurate for this code chunk.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 628)May include surrounding context.

md

| Error                                                    | Cause                       | Solution                                                                               |
| -------------------------------------------------------- | --------------------------- | -------------------------------------------------------------------------------------- |
| `Silent credential access requires explicit approval...` | Gate enabled, no approval   | Re-run with `--approve` (CLI) or call `db.explicit_credential_approval(True)` (Python) |
| `cloud_api_key is not configured`                        | Missing in config           | Get from portal and fill in                                                            |
| `Cloud unreachable: Network error...`                    | Cannot reach cloud          | Check network; verify URL ends with `/api/audit/logs`                                  |
| `Password not found`                                     | Env variable not set        | Run `set_env.ps1` / `set_env.sh`                                                       |

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill performs remote API-key introspection and fetches dbpw_key material from a cloud service before resolving database credentials, which creates an unnecessary dependency on a third-party endpoint for secret retrieval and identity validation. In this skill context, that is more dangerous because the tool already has outbound network, file, and environment permissions, so a compromised or malicious cloud service could influence local credential access, exfiltrate operational metadata, or deny database access.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/service_layer/db_bridge.py (reported line 150)May include surrounding context.

python

# set_env.sh - Encrypted MySQL password setup (reads dbpw_key from config)
# Run: eval "$(./set_env.sh)" to apply in current session
#
# Security Notice: This script does NOT automatically modify ~/.bashrc or ~/.zshrc.
# You must manually add the export line to your shell config if you want persistence.

SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The bridge exposes a require_cloud_api_key() path for cloud audit sync but does not provide a strong user-facing warning at the point of use that database activity may be transmitted to a remote endpoint configured in bootstrap defaults. In this skill context, outbound network permission plus preconfigured cloud audit infrastructure increases risk of unintended metadata or query audit exfiltration, especially if operators assume the tool is local-only.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The function docstring says Execute SELECT query, and the CLI parser help similarly describes the subcommand as a SELECT query interface. However, the code immediately warns that the command accepts arbitrary SQL and then passes the raw SQL to db.query(sql, params), so the inline documentation contradicts the actual capability.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The config command prints file paths, table metadata, and the full audit configuration without any approval gate or warning. In this skill's context, the audit config may contain sensitive operational details such as remote endpoints, identifiers, and policy data that materially aid reconnaissance or expose internal integration details to anyone invoking the command.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The document consistently mandates bilingual Chinese and English sections as the presentation format, rather than stating language support as optional or user-selectable. This can violate a language/locale policy when a skill implicitly enforces a specific locale pair without asking the user which language they prefer.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 94% confidence

Finding

The documentation explicitly states that the query command accepts arbitrary SQL and is not limited to SELECT. In a skill with database access, credential handling, file access, and outbound networking, allowing unrestricted SQL substantially increases the risk of destructive modification, privilege abuse, and sensitive data exposure, especially if operators assume 'query' is read-only.

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

md

>
> 3. **Bootstrap File Creation**: `bootstrap` command creates config files in `.sql_linker/` directory. `set_env.ps1/sh` generate encrypted credentials for OS environment variables (user-scope). User must manually add export line to shell config for persistence.
>
> 4. **Arbitrary SQL**: The `query` command accepts any SQL text (not limited to SELECT). Use parameterized queries to prevent injection.

### 中文

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file includes a user-facing status message in Chinese and English (只读模式禁止插入 / Read-only mode: insert blocked) rather than consistently honoring the user's preferred locale. Under the natural-language policy rule, forcing a specific language or bilingual output without a documented opt-in can violate locale policy expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This printed message combines Chinese and English (只读模式禁止更新 / Read-only mode: update blocked) without any visible locale selection mechanism. That creates a natural-language policy concern because the skill is choosing output language behavior on behalf of the user.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The delete-blocked message is hard-coded in both Chinese and English, with no indication that the user requested bilingual output. This is a locale-policy issue because the skill does not offer a language choice or justify the forced mixed-language presentation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The docstring and inline comment say the method updates audit_config.json only if the username field is empty and should not replace user-set values. However, in the non-empty case the code assigns self._username = current, and elsewhere cloud sync paths still treat cloud-derived agent data as authoritative for synchronization behavior, making the documentation overstate the non-overwrite guarantee.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The comment says the script does not automatically modify ~/.bashrc or ~/.zshrc, framing persistence as out of scope for the script itself. However, later output explicitly tells the user to add an export line to those files, which creates persistent credential storage behavior that the comment downplays in the documented intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The file includes user-facing natural-language text in both Chinese and English, such as the bootstrap docstring and printed dry-run message, without indicating that the user can choose a preferred language. This can violate a language/locale policy when a specific language experience is imposed without opt-in.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · scripts/service_layer/main.py (reported line 61)May include surrounding context.

python

def cmd_query(args):
    """Execute SELECT query."""
    print("[Security] ⚠️  The query command accepts arbitrary SQL (not limited to SELECT).")
    print("            Use parameterized queries (--params) to prevent injection attacks.")
    print("")
    db = DBBridge(user_label="cli", session_id="query", approved=getattr(args, 'approve', False))

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The docstring and parser help frame this command as requiring no connection, which can imply a local-only status check. In reality, fetch_api_key_info() performs remote cloud introspection and the handler explicitly treats network unreachability as an error, so the documentation misstates the operational dependency.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.