mec-aisql-cli

• Outcome: Review
• Latest audit: Aug 24, 2026 · 3:52 AM UTC
• Version: 1.0.0

Overview

The skill does what it claims, but it handles credentials and can automatically submit backend SQL work without enough safety controls for agent use.

Review before installing. Use only with a dedicated low-privilege MEC account, avoid passing real passwords on the command line, protect or remove ~/.minglue/tokens.json after use, do not run Bot/auto-perform flows unless you intend to submit backend SQL work orders, and treat any documented sample credential as exposed until confirmed revoked.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill documentation describes capabilities that read and write local files and make network requests, but it does not declare or constrain those permissions. This creates a trust and review gap: an agent may invoke a skill with broader side effects than users or platform policy expect, including token access, config modification, and backend task execution.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The report states the CLI looks up and carries brand-linked fields including `dtsaccount` and `dtspass` through the task flow. For a skill presented as SQL generation and task management, collecting and propagating downstream service credentials materially expands privilege and secret-handling scope, increasing the chance of accidental exposure in logs, errors, or operator misuse.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The CLI exposes high-impact state-changing operations beyond passive SQL generation/validation/querying, including task creation, execution, retry/stop, and agreement signing. In an agent setting, these commands can cause real remote side effects if invoked from natural-language prompts without explicit per-action authorization, increasing the risk of unintended job execution or account-level actions.

Context-Inappropriate Capability

Low

• Confidence: 85% confidence
• Finding: The `sql --save` feature writes retrieved SQL to an arbitrary local path provided by the caller, which gives an agent file-write capability outside the core remote AISQL workflow. In a hostile prompt or confused-deputy scenario, this could overwrite user files or drop content into sensitive locations if path restrictions are absent.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README explicitly states that login tokens are stored in ~/.minglue/tokens.json and configuration in ~/.minglue/aisql_config.json, while also showing password-based login. Exposing secret storage locations without warning or guidance increases the chance that users leave credentials or tokens insufficiently protected on disk, which can enable local credential theft, session hijacking, or accidental leakage via backups and dotfile sharing.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill promotes a fully automated flow that generates SQL, creates tasks, executes work orders, monitors progress, and fetches results, including use of an --auto-perform mode. Even with a SQL type guard, this is dangerous because generated queries and task execution are sent to backend systems without an explicit warning or mandatory human approval step, increasing the risk of unintended data access, expensive queries, or operational impact.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The documentation instructs users to log in with account credentials and states that tokens and configuration are stored in predictable filesystem locations, but it provides no warning about protecting those secrets. In this skill's context, those files may contain authentication tokens, API base URLs, and business identifiers that could be read, copied, or overwritten by other local processes or misused by an agent with file access.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The markdown includes a concrete login example with plaintext credentials (`dailijia` / `123456`) and presents it as a real end-to-end test. Publishing usable credentials in documentation creates immediate credential leakage risk, and readers may reuse or circulate them, leading to unauthorized access if the account remains valid or reflects real credential practices.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The deployment guidance tells users to log in and store tokens in `~/.minglue/tokens.json` without warning that tokens are sensitive bearer secrets. This normalizes local secret storage without discussing file permissions, encryption, rotation, or multi-user host risks, which can lead to token theft from shared systems or backups.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: download_result_file writes attacker- or caller-controlled content to an arbitrary caller-supplied local_path with no path validation, sandboxing, or user confirmation. In an agent/CLI context, this can overwrite files in the user's home directory or other writable locations, enabling destructive file clobbering or placement of malicious content in sensitive paths.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The login command accepts the password via a CLI option, which can expose credentials through shell history, process listings, audit logs, or terminal recordings on multi-user systems. In this skill context, the CLI is designed for both humans and automation, increasing the chance that secrets are passed unsafely in scripts or agent invocations.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The `create` command accepts `--dtsaccount` and `--dtspassword` and forwards them to the remote API, but the interface provides no special warning, masking behavior, or safer secret-handling path. This creates a meaningful risk of credential disclosure through shell history, process listings, agent logs, or accidental transmission by an automated caller.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The report exposes real login credentials in natural language and reinforces a pattern of supplying secrets directly on the command line. Command-line secrets can leak via shell history, process listings, CI logs, screenshots, and copied documentation, making this both an immediate disclosure issue and an unsafe operational practice.

Ssd 3

High

• Confidence: 95% confidence
• Finding: The document explicitly describes retrieving and passing sensitive brand-linked fields including `dtsaccount` and `dtspass` through the agent workflow. Even in a test report, this instructs operators and implementers to collect, move, and potentially expose passwords as ordinary task data, which raises the risk of leakage across logs, outputs, crashes, and debugging artifacts.

Session Persistence

Medium

• Category: Rogue Agent

Content

Args:
        data:     请求体字典 (会被就地修改)
        required: datetimefw 是否必填 (gen/create 必填, validate 可选)
        fmt:      输出格式:
                  - "slash" (默认): "YYYY-MM-DD/YYYY-MM-DD" 字符串
                    用于 gen/validate (datetimefw 仅拼进 prompt 或做正则匹配)

• Confidence: 88% confidence
• Finding: The client persists access and refresh tokens to ~/.minglue/tokens.json without setting restrictive file permissions or using a secure credential store. On multi-user systems or misconfigured environments, local users or malware with filesystem access could read or reuse long-lived tokens to impersonate the user against the MEC platform.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

• Category: Supply Chain
• Confidence: 96% confidence
• Finding: The project declares an unbounded dependency on requests>=2.31.0, and the scanner reports multiple known advisories affecting versions that satisfy this range. Because this CLI communicates with remote services for AI SQL generation and task management, a vulnerable HTTP client can expose credentials, mishandle redirects/TLS state, or leak sensitive request data in realistic usage.

Static analysis

No suspicious patterns detected.