Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

sqlserver-tidb-replay

v1.0.0

Replay SQL Server slow query logs on TiDB to verify compatibility, compare performance, and generate syntax conversion reports during migration.

0· 39·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description, SKILL.md, and the four included scripts (CSV→SQL, CSV parsing, replay to TiDB, analysis) are coherent: all are directly related to replaying SQL Server slow queries on TiDB and generating compatibility/performance reports.
Instruction Scope
SKILL.md restricts actions to local log collection, CSV normalization, JSON conversion, replay to TiDB, and local analysis. It instructs running a PowerShell collector (collect_xe.ps1) which is not included in the package. The runtime instructions reference environment variables (TIDB_*) and CLI args as ways to provide TiDB credentials; the skill will execute arbitrary SQL statements against the target TiDB instance (expected for this purpose) — so run only against test/replica environments.
Install Mechanism
No install spec is present (instruction-only + code files), so nothing will be automatically downloaded or executed during install. The scripts require Python packages (pymysql, pandas) but the skill does not include an automated installer — you must install dependencies manually. No suspicious external download URLs or extract steps are present.
!
Credentials
Registry metadata lists no required environment variables, but SKILL.md and replay_tidb.py expect/mention TIDB_HOST, TIDB_PORT, TIDB_USER, TIDB_PASSWORD, TIDB_DATABASE (via CLI args or os.getenv). That mismatch (declared none vs actual usage) is an incoherence that could confuse permission/secret handling. The scripts will accept credentials and will use them to connect and execute SQL — these are sensitive and must be scoped to non-production accounts.
Persistence & Privilege
Skill does not request always:true and does not modify other skills or system configuration. It operates only when invoked and writes its own output files to configurable directories; autonomy and persistence are normal and not elevated here.
What to consider before installing
This skill appears to do what it says (parse SQL Server slow logs, convert SQL, replay to TiDB, and generate reports), but review and take these precautions before use: - Run only in a test/replica environment. The replay script will execute SQL statements against the provided TiDB endpoint and can modify data. - Provide TiDB credentials with least privilege (ideally a read/limited account or a copy of production data in a sandbox). Avoid using highly privileged or production admin credentials. - The package metadata lists no required env vars, but the README/scripts expect TIDB_HOST,TIDB_PORT,TIDB_USER,TIDB_PASSWORD,TIDB_DATABASE — ensure you supply them securely (prefer CLI args or a secrets manager over committing env vars into shared shells). - The SKILL.md recommends running a PowerShell collector (collect_xe.ps1) that is not included. Obtain and inspect that collector script from a trusted source before running it on Windows servers. - Install Python dependencies (pymysql, pandas) in an isolated virtualenv and inspect the code yourself. The included scripts are readable; verify any additional third-party code you install. - Backup any target database or use an isolated test cluster. Consider running with a user that has transactional or read-only permissions where possible. If you want higher confidence: ask the publisher for the missing collect_xe.ps1, update the skill metadata to declare required env vars, and provide a requirements.txt or install instruction so dependency installation is explicit.

Like a lobster shell, security has layers — review code before you run it.

databasevk973jp4jaqvchax6m9xg9hy78d84qz73latestvk973jp4jaqvchax6m9xg9hy78d84qz73migrationvk973jp4jaqvchax6m9xg9hy78d84qz73sql-servervk973jp4jaqvchax6m9xg9hy78d84qz73tidbvk973jp4jaqvchax6m9xg9hy78d84qz73

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Comments