ClawHub
Back to skill

Security audit

Db Internals Deep Dive

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only teaching skill for database internals and does not request code execution, credentials, persistence, or system access.

This skill is reasonable to install if you want structured database-internals explanations. The main caveat is that its activation examples are somewhat broad, so it may steer some general database questions into a deep-dive teaching format; it does not ask for credentials, execute code, or modify files.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trigger list includes broad phrases like "db internals today" and "deep dive vào database," which can match ordinary user requests beyond the intended niche. Overly broad activation can cause the skill to hijack general database conversations, leading to misrouting, loss of least-privilege behavior, and unintended invocation of specialized instructions.

Session Persistence

Medium
Category
Rogue Agent
Content
### Redis

- **Data Structures Internals**: ziplist vs listpack vs skiplist (when Redis switches encoding — size thresholds), hashtable with incremental rehashing, quicklist for lists, intset for small integer sets
- **Persistence**: RDB (fork-based snapshot, BGSAVE, COW semantics), AOF (fsync policies: always/everysec/no, AOF rewrite/compaction), RDB+AOF hybrid mode
- **Memory Management**: jemalloc allocator, memory fragmentation ratio, maxmemory policies (noeviction, allkeys-lru, volatile-lru, allkeys-lfu, volatile-ttl), object encoding optimization
- **Replication**: async replication (PSYNC2), replication backlog (repl-backlog-size), partial resync vs full resync, replica lag detection
Confidence
75% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Vague Triggers

Low
Confidence
91% confidence
Finding
The trigger list includes broad phrases like "db internals today" that can activate on vague, non-specific user requests. In an agent-routing context, overly broad activation can cause unintended skill selection, leading the agent to apply specialized instructions outside the intended scope and produce irrelevant or misleading outputs.

Natural-Language Policy Violations

Low
Confidence
77% confidence
Finding
The trigger list mixes English examples with the Vietnamese phrase "deep dive vào database," but the document does not explain whether multilingual triggering is intentional or user-selectable. This can create an implicit language/locale behavior without clear opt-in or documented policy.

Vague Triggers

Low
Confidence
91% confidence
Finding
The trigger description lacks clear activation boundaries and exclusion rules, so the agent has no guidance on when not to invoke this skill. This increases the risk of misrouting ordinary database questions into a deep-internals workflow, which can degrade answer quality and bypass more appropriate skills or default handling.

Static analysis

No suspicious patterns detected.