ClawHub
Back to skill

Security audit

NocoDB API

Security checks for vulnerabilities and agentic risk

Overview

This NocoDB skill is a coherent API wrapper, but it gives an agent broad database, admin, token, membership, deletion, and file-upload authority with limited guardrails.

Review this before installing on a production NocoDB account. Use a least-privilege token, avoid echoing or sharing the token, prefer a test workspace first, and require explicit human approval before delete, schema, token, team, membership, script, or file-upload actions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (14)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The description frames the skill mainly as a NocoDB data/query integration, but the documented commands also include higher-risk administrative actions such as membership management, team management, API token operations, and scripts. This mismatch can mislead users and policy systems about the privilege level of the skill, causing overbroad trust and accidental execution of tenant-wide or credential-affecting actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README prominently advertises create, update, delete, and schema-management capabilities without any caution about irreversible changes, required confirmations, backups, or least-privilege token use. In an agent skill context, this increases the likelihood that users or autonomous workflows invoke destructive operations against production data without understanding the consequences.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The setup instructions tell users to export an API token directly in the shell without warning that credentials are sensitive and may be exposed through shell history, shared terminals, process inspection, logs, or copied session transcripts. Because this skill grants database access and potentially destructive actions, token leakage could enable unauthorized reading, modification, or deletion of NocoDB data.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill exposes shell-backed capabilities but does not declare any tool scope such as permissions or allowed-tools. That makes the effective execution surface broader and less auditable, increasing the chance that an agent can invoke shell operations with more authority than a user or platform reviewer expects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill documents destructive operations such as delete, update, and schema changes without any cautionary guidance, confirmation flow, or backup recommendation. In an agent setting, this raises the likelihood of accidental data loss or irreversible structural changes when a user intends only read-only or low-risk actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The troubleshooting section explicitly suggests printing the full API token with echo $NOCODB_TOKEN, which can expose credentials in terminal history, logs, screen recordings, CI output, or agent transcripts. Because this skill can perform administrative NocoDB actions, leaked tokens could enable unauthorized data access, destructive changes, or further credential management actions.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/nocodb.sh (reported line 15)May include surrounding context.

sh
_v() { [[ "$NC_VERBOSE" == "1" ]] && echo "→ $*" >&2 || true; }

_get()    { curl -sS -H "xc-token: $NC_TOKEN" "$NC_URL/api/v3/$1"; }
_post()   { curl -sS -X POST -H "xc-token: $NC_TOKEN" -H "Content-Type: application/json" "$NC_URL/api/v3/$1" -d "${2:-}"; }
_patch()  { curl -sS -X PATCH -H "xc-token: $NC_TOKEN" -H "Content-Type: application/json" "$NC_URL/api/v3/$1" -d "${2:-}"; }
_put()    { curl -sS -X PUT -H "xc-token: $NC_TOKEN" -H "Content-Type: application/json" "$NC_URL/api/v3/$1" -d "${2:-}"; }

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This shell script provides direct deletion commands such as workspace:delete with no confirmation prompt, warning message, or explanatory comment before executing irreversible API deletions. The same pattern appears throughout the command dispatch, so a user invoking a delete command gets no explicit disclosure that data or configuration will be removed immediately.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill can list, add, update, and remove workspace and base members, but that capability is not disclosed in the description. Hidden membership management is security-relevant because it can change who has access to data and administration functions, creating a privilege-management surface users may not expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The record deletion path performs authenticated remote deletion and accepts flexible input shapes, enabling irreversible bulk data removal. In an agent skill context, lack of any guardrail, preview, or explicit confirmation increases the chance of unintended destructive actions from prompt mistakes or overbroad tool use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The upload command sends an arbitrary local file path to a remote NocoDB endpoint, which can exfiltrate local contents if an agent is induced to reference sensitive files. In a tool-using agent environment, file-upload primitives are high risk unless clearly disclosed and constrained because local-to-remote data flow may not be obvious at invocation time.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script exposes administrative capabilities for scripts, teams, and tokens that go beyond the stated skill description focused on databases, schema, records, links, filters, sorts, and attachments. This scope mismatch is dangerous because an invoking agent or user may grant trust assuming data CRUD only, while the skill can also alter access structures and create or delete authentication artifacts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The setup instructions tell users to create and export an API token but do not warn that the token is a secret with potentially broad access to NocoDB resources. This omission increases the risk of careless handling, accidental sharing in transcripts, shell history, or logs, and downstream compromise if the token is exposed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The script reads NOCODB_TOKEN from the environment and uses it in HTTP headers for all API requests, but beyond requiring its presence it does not provide any user-facing explanation that an API credential will be used for authenticated remote operations. Access to sensitive environment variables is in scope for this rule when there is no disclosure in code or adjacent documentation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.