Security audit

自然语言转 SQL 查询助手

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real MySQL SQL assistant, but it handles database passwords and transaction output in ways that can expose sensitive information.

Install only if you are comfortable with a skill that can run SQL against MySQL databases. Use least-privilege database accounts, avoid production credentials, avoid passing passwords on the command line, and review generated SQL before any write, delete, drop, truncate, or transaction operation.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/query.sh:18
Finding: Database Passwords Exposed Through Process Command-Line Arguments
Content: View full analysis
Remediation: View remediation
"$CREDENTIAL_FILE" <

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:72
Finding: Predictable SQL Files in the Shared Temporary Directory
Content: View full analysis
/scripts/query.sh /tmp/query.sql [--host ...] ``` **Transaction (multiple atomic statements):** Write statements to a temp file, then: ```bash bash /scripts/transaction.sh /tmp/tx.sql [--host HOST --port PORT --user USER --password PASS] ``` ``` The referenced scripts subsequently trust and consume the supplied paths. For example, `scripts/query.sh:24-28` reads the file without ownership or symlink validation: ```bash if [[ -f "$SQL_INPUT" ]]; then SQL=$(cat "$SQL_INPUT") else SQL="$SQL_INPUT" fi ``` Similarly, `scripts/transaction.sh:26-33` streams the file directly to MySQL: ```bash { echo "SET autocommit=0;" echo "START TRANSACTION;" cat "$SQL_FILE" echo "" echo "COMMIT;" } | mysql "${CONN_ARGS[@]}" "$DB" --verbose 2>&1 ``` ### Technical Analysis The workflow directs the Agent to use fixed names, `/tmp/query.sql` and `/tmp/tx.sql`, in a commonly shared temporary directory. Predictable paths allow another local principal to anticipate the file name. The instructions do not require exclusive file creation, restrictive permissions, file ownership verification, rejection of symbolic links, or secure cleanup. The execution scripts only check whether a path is a file and do not ensure that it was securely created by the current process. This creates multiple risks: - SQL contents may be readable by another local user if created with permissive permissions. - An attacker may replace the file between creation and use. - A pre-created symbolic link may cause an unsafe writer to overwrite another file accessible to the Agent. - Substituted SQL may execute with the privileges of the configured database account. ### Attack Path A substitution attack can proceed as follows: ...[truncated 1364 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/transaction.sh:26
Finding: Transaction Statements May Be Disclosed Through Verbose MySQL Output
Content: View full analysis
&1 ``` ### Technical Analysis The transaction script invokes MySQL with `--verbose`, causing submitted statements to be reproduced in execution output. It also applies `2>&1`, merging diagnostic output with standard output so that the combined stream can be captured by the Agent, orchestration layer, logs, or user-facing response. Transaction files may legitimately include confidential values, such as: - Authentication tokens. - Password hashes or temporary credentials. - Personal or financial information. - Private application configuration. - Sensitive business records included in `INSERT` or `UPDATE` statements. Because the complete SQL is supplied through standard input while verbose mode is enabled, these literals may be echoed verbatim. This conflicts with the Skill documentation's claim that sensitive credentials will never appear in output or logs. ### Attack Path 1. A user requests a multi-statement transaction containing confidential literal values. 2. The Agent writes those statements to the transaction SQL file. 3. `transaction.sh` sends the file to MySQL with `--verbose`. 4. MySQL reproduces the submitted statements, including sensitive literals. 5. `2>&1` places the verbose output in the combined output stream. 6. The Agent framework, terminal history, CI log, monitoring platform, or user-facing response records the sensitive content. 7. A person with access to those records recovers the disclosed information. The attacker must be able to access the resulting output or execution logs; this issue does not independently bypass database authorization. ### Impact Assessment The vu ...[truncated 549 chars]
Remediation: View remediation
&1`. 4. Return a minimal status message and sanitized database error details. 5. If diagnostics are necessary, redact quoted literals, credentials, tokens, and personal data before logging. 6. Disable shell tracing around all credential and SQL processing. 7. Define a logging policy that limits retention and access to database execution diagnostics. 8. Add tests that submit recognizable secret values and verify that those values do not appear in any output stream. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description presents a full-featured natural-language SQL assistant with broad database execution capabilities. The actual code is much narrower: it only parses connection flags and runs one hardcoded MySQL query to enumerate databases. While the code does use MySQL connection info as described, its primary behavior is limited to database listing and does not implement the core claimed functionality of translating natural language into SQL or executing arbitrary database operations. This is a material description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description promises a broad NL-to-SQL assistant capable of generating and executing arbitrary SQL against MySQL, including data modification, transactions, and multiple output formats. The supplied code does something much narrower: it accepts a database and optional table name plus connection flags, then runs SHOW TABLES and SHOW CREATE TABLE to display schema definitions. While remote MySQL connection support via host/port/user/password is consistent with part of the description, the core behavior is materially different. There is no natural-language handling, no SQL synthesis, no execution of user-specified queries, no CRUD operations beyond schema inspection, and no transaction or export-format support. Therefore the description significantly overstates and misrepresents the code's actual purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The declared description presents a full natural-language SQL assistant whose primary function is translating user requests into SQL and executing them, with broad database operation support and multiple output formats. The supplied code does not do any natural language processing or SQL generation. It only reads an existing SQL file and pipes it to the MySQL client within an explicit transaction, using optional remote connection arguments. While parts of the description overlap—MySQL connectivity, execution of SQL, and transaction support—the main advertised capability is missing, and the implemented behavior is materially narrower than described.
Content: No source excerpt is available for this finding.

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · references/guide.md (reported line 44)May include surrounding context.
md
### DELETE - **Always include a WHERE clause** — never generate bare `DELETE FROM ...` - Prefer soft-delete (status field) if table has one - Confirm with user before generating DELETE statements ### Transactions - Use transactions when:

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger conditions are extremely broad and cover common phrases such as querying databases, writing SQL, modifying data, exporting, and connecting to databases. In an agent environment, this can cause the skill to activate unexpectedly on routine conversations and grant a path to database-oriented actions, increasing the chance of unintended data access, destructive operations, or credential handling in the wrong context.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest describes a natural-language-to-SQL assistant that can generate SQL, execute user-requested CRUD and transaction operations, and return results in multiple formats. This file's actual behavior is much narrower: it only accepts connection parameters and runs a fixed query against information_schema to enumerate databases, with no natural-language parsing, arbitrary SQL execution, write operations, transactions, or selectable output formats.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script accepts a database password via a command-line argument and forwards it as -pPASSWORD to mysql, which can expose secrets through process listings, shell history, audit logs, or orchestration telemetry. In a skill that allows user-supplied remote database credentials, this becomes more dangerous because highly sensitive credentials may be routinely passed through an unsafe channel.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script accepts the database password via the --password flag and passes it to mysql as -p<password>, which exposes the secret in process arguments. On many systems, command-line arguments can be observed by other local users via tools like ps, shell history, logging, job control output, or orchestration telemetry, causing credential disclosure. In this skill's context, the risk is elevated because it explicitly supports remote MySQL connections and user-supplied credentials, increasing the likelihood that real production passwords will be handled this way.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script accepts the database password via a --password argument and passes it to mysql as -p, which exposes the credential in process arguments. On many systems, command-line arguments can be read by other local users through process listings, shell history, audit logs, or orchestration metadata, causing credential disclosure. In this skill's context, the risk is elevated because it explicitly supports remote MySQL connections with user-supplied credentials, increasing the likelihood that real production secrets are handled this way.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The instruction 'Chinese aliases when user speaks Chinese' imposes a language-specific output rule automatically rather than offering a user choice. This can violate language/locale policy requirements when a skill should not force a locale without explicit opt-in or documented justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script forces Chinese-language output strings and column aliases, which is a natural-language locale constraint embedded in a code file. There is no opt-in, fallback, or documentation indicating that the tool is intentionally region-specific.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.