Security audit

openclaw ggsql

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent ggsql chart-generation helper with optional local execution steps, but users should treat the local installs and generated SQL as code they choose to run.

Install only from trusted ggsql package sources, preferably with pinned versions. Review generated SQL before running it, especially when chart specs or data paths come from someone else, and avoid uploading sensitive datasets to the web playground unless that is acceptable for your use case.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:218
Finding: Unpinned Third-Party Executable Dependencies
Content: View full analysis
Remediation: View remediation
--locked uv tool install 'ggsql-jupyter==' ``` 2. Verify package integrity through trusted checksums or cryptographic signatures where supported. 3. Document the expected package publisher, source repository, and reviewed release. 4. Use lockfiles or equivalent reproducible dependency metadata. 5. Review dependency changes before updating pinned versions. 6. Prefer installation from a verified artifact or commit when the package ecosystem cannot provide sufficient integrity guarantees. 7. Recommend execution in a least-privileged or sandboxed environment. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: templates/scatter.sql:5
Finding: Unescaped Input Interpolation into Executable SQL Templates
Content: View full analysis
'{title}', x => '{x_label}', y => '{y_label}' ``` Other affected interpolation patterns include: ```sql SELECT {x_column}, {y_column} {#if fill_column} , {fill_column}{/if} FROM '{data_source}' {#if group_by}GROUP BY {group_by}{/if} ``` ```sql DRAW histogram SETTING binwidth => {binwidth} ``` The resulting SQL is passed directly to the CLI: ```bash if command -v ggsql-cli &> /dev/null; then ggsql-cli run -f "$INPUT_SQL" -o "$OUTPUT_FILE" --format "$FORMAT" echo "Chart generated: $OUTPUT_FILE" exit 0 fi ``` ### Technical Analysis The templates directly interpolate several distinct classes of input into executable SQL: - File or data-source strings. - SQL identifiers such as columns and grouping fields. - SQL fragments such as scales and faceting fields. - Numeric settings such as histogram bin width. - Quoted labels and chart titles. No escaping, identifier allowlist, numeric type validation, statement-count restriction, or path confinement is specified. Quoting `data_source`, `title`, and labels with single quotes is insufficient if an input can itself contain a quote. Identifier fiel ...[truncated 2233 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill documents shell-capable execution methods such as cargo install, ggsql-cli, and uv tool install, but the manifest does not declare any permissions or allowed-tools scope. This creates an undeclared capability boundary: an agent may infer that shell execution is expected without explicit restriction, increasing the risk of unexpected command execution or tool misuse in environments where skills are auto-wired to tools.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/ggsql-runner.sh (reported line 26)May include surrounding context.
sh
echo "" echo "Save output as: $OUTPUT_FILE" # Alternative: curl to API (if available in future) # curl -X POST https://ggsql.org/api/render \ # -d "sql=$(cat $INPUT_SQL)" \ # -d "format=$FORMAT" \

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest description on L003 claims a narrower supported chart set than the rest of the file actually presents. Later sections document additional chart types and composition features, so the stated capabilities and the documented behavior are inconsistent.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The manifest says the skill supports scatter plots, line charts, bar charts, histograms, boxplots, and heatmaps. However, the input schema and later sections also support violin, density, pie, faceting, and multi-layer charts, which broadens the actual skill behavior beyond the stated manifest scope.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.