T09 · Insecure Skill Coding Practices
- Location
SKILL.md:63- Finding
Unsafe SQL Construction with User-Controlled Note Content and Search Terms
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 63 and 68
Vulnerability Type: SQL injection through direct interpolation of user-controlled values
Risk Level: HighVulnerable Code
sql INSERT INTO notes (content) VALUES ('优化后的笔记内容');sql SELECT * FROM notes WHERE content LIKE '%关键词%';Technical Analysis
The skill documentation instructs the agent to embed optimized note content and search keywords directly into SQL string literals. Both values originate from user input, but the documented queries do not use parameter binding or define an escaping procedure.
A single quote in ordinary note content can cause a syntax error. More deliberately crafted input could terminate the original string literal and append attacker-selected SQL. Whether stacked statements can execute depends on the SQLite interface used by the host agent, which is not included in the audited project. Even when stacked statements are rejected, unsafe interpolation can still permit query manipulation or denial of service.
Attack Path
- An attacker asks the agent to create a note or search for a keyword containing a quote and malicious SQL syntax.
- The agent follows
SKILL.mdand places that value directly inside the documented SQL literal. - The resulting SQL changes structure rather than treating the complete value as data.
- The SQLite execution layer evaluates the modified query.
- Depending on the database API and permissions, the attacker may manipulate query results, corrupt or delete notes, modify archive state, or disrupt note operations.
Example malicious note content, assuming the execution interface permits multiple statements:
text '); DELETE FROM notes; --This could produce:
sql INSERT INTO notes (content) VALUES (''); DELETE FROM notes; --');Impact Assessment
Exploitation is limited to the permissions of the process executing SQLite operat ...[truncated 705 chars]
- Remediation
View remediation
Remediation Suggestions
Use parameterized statements for every user-controlled value. Do not ask the agent to generate SQL by concatenating or interpolating note content or search terms.
For example, with Python's
sqlite3API:python connection.execute( "INSERT INTO notes (content) VALUES (?)", (optimized_content,), ) connection.execute( "SELECT * FROM notes WHERE content LIKE ?", (f"%{keyword}%",), )Additional hardening measures should include:
- Encapsulate all database operations in reviewed scripts rather than having the agent construct arbitrary SQL.
- Expose narrowly scoped operations such as
add,search,list, andarchive. - Validate note IDs as integers before using them in archive or lookup operations.
- Reject operation types outside an explicit allowlist.
- Execute only one prepared statement per operation.
- Run database operations with the minimum filesystem permissions required.
- Maintain protected backups and test restoration procedures.
- Add tests using quotes, SQL metacharacters, comment sequences, and attempted stacked statements.