sqlserver-tidb-replay

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:40 AM UTC
• Version: 1.0.0

Overview

This database replay skill is coherent in purpose, but it gives users high-impact database execution workflows with weak safety controls and a published root-password example.

Install only after reviewing the scripts and removing the hardcoded password example. Use a dedicated least-privileged TiDB account, never root, and run replay only against an isolated disposable test database. Treat captured SQL, JSON, CSV, and HTML reports as sensitive production data; redact or restrict access before sharing. Require TLS for remote TiDB connections, inspect replay JSON before execution, and do not open reports generated from untrusted inputs.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:326

Finding

Plaintext Administrative Database Credential Embedded in Documentation

Content

View full analysis

Remediation

View remediation

`. 4. Remove the credential from Git history, package caches, release artifacts, and generated documentation where feasible. 5. Do not recommend the TiDB `root` account. Create a dedicated replay account restricted to: - A disposable test database. - Only the required tables and operations. - Approved source hosts. - A limited validity period. 6. Retrieve credentials from a protected secret manager or prompt for them interactively. 7. Avoid passing secrets through command-line arguments. If environment variables are supported, warn that they may still be exposed in process environments and CI diagnostics. 8. Add automated secret scanning to repository and release workflows. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/replay_tidb.py:65

Finding

Unrestricted Execution of User-Controlled Replay SQL

Content

View full analysis

tuple[int, Optional[str], Optional[int], int]: """ 执行单条SQL 返回: (replay_duration_us, error_msg, error_code, row_count) """ start = time.perf_counter() try: with conn.cursor() as cursor: cursor.execute(sql) if sql_type.lower() in ("select", "cte", "merge"): results = cursor.fetchall() row_count = len(results) else: row_count = cursor.rowcount row_count = row_count if row_count is not None else 0 except pymysql.err.OperationalError as e: return int((time.perf_counter() - start) * 1_000_000), str(e), e.args[0] if e.args else None, 0 except pymysql.err.IntegrityError as e: return int((time.perf_counter() - start) * 1_000_000), str(e), e.args[0] if e.args else None, 0 except pymysql.err.ProgrammingError as e: return int((time.perf_counter() - start) * 1_000_000), str(e), e.args[0] if e.args else None, 0 except pymysql.err.DataError as e: return int((time.perf_counter() - start) * 1_000_000), str(e), e.args[0] if e.args else None, 0 except Exception as e: return int((time.perf_counter() - start) * 1_000_000), str(e), -1, 0 else: return int((time.perf_counter() - start) * 1_000_000), None, None, row_count ``` The untrusted value originates from replay input: ```python conn_id = item["conn_id"] sql = item["sql"] sql_type = item["sql_type"] ``` ### Technical Analysis The replay script loads SQL text from a user-selected JSON file and passes it directly to `cursor.execute`. It does not enforce an allowlist, reject destructive DDL, verify that the declared `sql_type` matches the statement, detect m ...[truncated 1877 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/replay_tidb.py:48

Finding

TiDB Connection Does Not Require or Verify TLS

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/analyze_results.py:426

Finding

Stored HTML Injection Through Unescaped SQL and Report Metadata

Content

View full analysis

源数据库：{source_db}

目标数据库：{target_db}

回放耗时：{summary.get('elapsed_seconds', 'N/A')} 秒

回放任务：{summary.get('task_name', 'N/A')}

``` Captured SQL and database errors are also inserted directly into HTML: ```python

{rec['sql']}

``` ```python

{item['sql'][:150]}...

{item.get('error', 'N/A')[:80]} ``` ```python

{item['sql'][:100]}...

{item.get('sql_type', 'N/A')} ``` ### Technical Analysis The HTML report generator constructs markup through string interpolation without applying context-appropriate escaping. Several values are attacker-controllable or derived from untrusted data: - SQL text from replay result JSON. - Database error messages. - SQL type fields. - Task names and summary metadata. - `source_db` and `target_db` command-line arguments. An attacker can place HTML elements or JavaScript event handlers in SQL comments, quoted identifiers, metadata, or a crafted result file. When the report is generated, these values become executable markup rather than inert text. Truncating values does not neutralize markup. The generated document also has no restrictive Content Security Policy to mitigate injected active content. ### Attack Path 1. An attacker introduces an HTML payload into captured SQL, a replay JSON result, a database error message, or report metadata. 2. An operator runs `analyze_results.py`. 3. The payload is interpolated into the generated HTML without escaping. 4. A victim opens the report in a browser. 5. The browser interprets the payload as markup and may execute attacker-cont ...[truncated 648 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/csv_to_sql.py:181

Finding

Sensitive SQL Text Is Unnecessarily Duplicated in Intermediate CSV Output

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This script loads SQL statements from a JSON file and replays them directly against a live TiDB database with no validation, dry-run mode, confirmation prompt, or restriction to read-only statements. Because the input can contain destructive or dangerous statements such as DROP, DELETE, TRUNCATE, DDL changes, or TiDB-specific administrative SQL, running the tool on untrusted or mistaken input can cause data loss, schema corruption, or service disruption.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill describes collecting slow-query logs and transforming them into CSV/JSON artifacts containing raw SQL text, database names, session IDs, timestamps, and performance metadata without a clear privacy or data-handling warning. Such artifacts can contain sensitive business data, embedded literals, schema details, or operational metadata, and the absence of guidance increases the risk of accidental disclosure, insecure storage, or unsafe sharing of replay inputs and reports.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation explicitly demonstrates replaying captured SQL that includes insert, update, and delete statements against TiDB, but it does not prominently warn that replay will execute writes and can alter or corrupt target data. In the provided migration/validation context, users may copy the example workflow and accidentally run production-derived write traffic against a non-isolated or insufficiently protected environment, causing integrity loss and unintended state changes.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This code file contains natural-language UI content that forces a specific locale: the HTML declares lang="zh-CN" and the surrounding report labels and messages are all in Chinese. Under the policy, language/locale constraints should not be imposed unless the skill offers a choice or clearly documents and justifies the restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code file contains user-facing natural language exclusively in Chinese, including the top-level description and later CLI/help strings, which effectively imposes a specific language on users. The policy allows fixed locale behavior only when it is clearly justified as region-specific or when users are given a language/locale choice, neither of which is present here.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The argument help and option name imply that administrator/system SQL removal is a user-controllable behavior. However, parse_row unconditionally calls is_admin_sql and returns None for matching statements at L98-L99, and main never checks args.remove_admin before applying that filtering. This is an active contradiction between the documented interface and actual behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file's natural-language strings, including the module docstring, error output, argument help text, and status messages, are written exclusively in Chinese. This imposes a fixed language/locale on users without any opt-in, which matches the language policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The example invocation includes --lang cn, which indicates a fixed language/locale setting in the workflow. The document does not present this as optional or offer alternative locales, so it can be interpreted as enforcing a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This code file includes a natural-language locale policy choice with --lang defaulting to cn, which forces a specific language unless the user notices and overrides it. The policy allows language constraints only when the user is offered a choice or explicitly opts in; here a choice exists, but the default still imposes Chinese automatically.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.