ClawHub
Back to skill

Security audit

Mssql Toolkit

Security checks for vulnerabilities and agentic risk

Overview

This SQL Server helper is mostly coherent, but its documented connection pattern can expose the database password in process arguments and it tells users to bypass certificate validation by default.

Review before installing. Use a least-privileged SQL Server account, prefer authentication that does not put reusable passwords on the command line, avoid using -C except as an explicit temporary development exception, and ensure any write-capable account is tightly scoped and backed by backups or transaction review.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:34
Finding

Database Password Exposed Through Process Arguments

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 34; the same unsafe pattern is repeated at lines 53, 59, 65, 71, 77, 83, and 89
Vulnerability Type: Command-line credential exposure
Risk Level: High

Vulnerable Code

bash
${MSSQL_SQLCMD:-sqlcmd} -S $MSSQL_HOST -U $MSSQL_USER -P $MSSQL_PASSWORD -d $MSSQL_DB -C -W -Q "YOUR_QUERY"

Technical Analysis

The documented connection command supplies the database password through the sqlcmd -P argument. After shell expansion, the plaintext password becomes part of the process command line.

Depending on operating-system permissions and runtime configuration, command-line arguments may be visible through process inspection facilities, administrative monitoring agents, diagnostic captures, audit logs, crash reports, or enabled shell tracing. This undermines the stated rule that credentials must never be exposed.

The vulnerability occurs whenever the Agent follows any of the documented commands containing:

bash
-P $MSSQL_PASSWORD

Attack Path

  1. A user or Agent invokes one of the documented sqlcmd commands.
  2. The shell expands $MSSQL_PASSWORD into its plaintext value.
  3. The resulting password is included in the sqlcmd process arguments.
  4. An attacker with access to process metadata, privileged host telemetry, diagnostic logs, or command tracing captures the argument while the process runs or from retained records.
  5. The attacker uses the exposed host, username, password, and database details to authenticate to SQL Server.
  6. The attacker performs operations allowed by the compromised database account.

This attack requires suitable local observation, monitoring, logging, or diagnostic access; the document does not itself transmit the credential externally.

Impact Assessment

A successful attacker obtains the reusable SQL Server password. The resulting scope is bounded by the permissions assigned to MSSQL_USER, but may include:

  • Reading sensitive records ...[truncated 454 chars]
Remediation
View remediation

Remediation Suggestions

  1. Do not pass database passwords through the -P command-line option.
  2. Prefer an approved authentication mechanism that avoids reusable command-line secrets, such as:
    • Windows or Kerberos integrated authentication where available.
    • Microsoft Entra authentication supported by the installed sqlcmd version.
    • A protected credential configuration or enterprise secret provider.
  3. If password authentication is unavoidable, use a supported input mechanism that does not place the password in process arguments and ensure that it cannot be recorded by shell history or tracing.
  4. Run the database client under a dedicated, least-privileged operating-system identity.
  5. Assign the database identity only the minimum permissions required for schema inspection and read operations.
  6. Disable command tracing around credential-bearing operations and review monitoring, crash-reporting, and audit systems for command-line collection.
  7. Rotate the configured SQL Server password if the documented command has already been used in an environment where process arguments may have been retained.
  8. Update every repeated command at lines 53, 59, 65, 71, 77, 83, and 89 rather than correcting only the primary example.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:34
Finding

Mandatory SQL Server Certificate Trust Bypass

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 34–40; -C is also used at lines 53, 59, 65, 71, 77, 83, and 89
Vulnerability Type: Improper TLS certificate validation
Risk Level: Medium

Vulnerable Code

bash
${MSSQL_SQLCMD:-sqlcmd} -S $MSSQL_HOST -U $MSSQL_USER -P $MSSQL_PASSWORD -d $MSSQL_DB -C -W -Q "YOUR_QUERY"
markdown
## Required Flags

- `-C` trust server certificate (always required for modern MSSQL)
- `-Q` run query and exit
- `-W` remove trailing whitespace

Technical Analysis

The Skill declares -C, which tells sqlcmd to trust the server certificate, as an always-required flag and includes it in every connection example. This bypasses normal certificate trust validation instead of requiring a certificate issued by a trusted authority and valid for the intended SQL Server hostname.

Encryption without reliable peer authentication does not establish that the client is communicating with the legitimate database server. In a network where an attacker can intercept or redirect SQL Server traffic, trusting an arbitrary certificate can enable server impersonation.

The statement that this bypass is always required for modern MSSQL encourages insecure production deployment rather than limiting it to an explicit development exception.

Attack Path

  1. The Agent follows the documented command and connects with -C.
  2. An attacker gains a network interception or redirection position, such as through compromised routing, DNS manipulation, a malicious gateway, or control of an adjacent network segment.
  3. The attacker redirects the SQL Server connection to an attacker-controlled endpoint or interception proxy.
  4. The endpoint presents a certificate that would normally fail trust-chain or identity validation.
  5. Because the client was instructed to trust the server certificate, the invalid certificate is accepted.
  6. The attacker impersonates or proxies the database server and may observe authentication mater ...[truncated 1050 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove -C from the default and required connection command.
  2. Configure SQL Server with a certificate that:
    • Chains to a trusted certificate authority.
    • Is valid for the server hostname used by the client.
    • Is within its validity period and has appropriate server-authentication usage.
  3. Connect using a stable DNS hostname that matches the certificate rather than an unverified raw address where practical.
  4. Install the required private certificate authority chain in the client trust store when an internal PKI is used.
  5. Permit -C only as an explicit, temporary development exception, accompanied by a warning that it disables certificate verification and must not be used in production.
  6. Add deployment checks that fail when certificate verification is disabled in production environments.
  7. Remove -C from every repeated example at lines 53, 59, 65, 71, 77, 83, and 89.
  8. Use a secure authentication mechanism in addition to certificate validation; TLS server authentication and database-user authentication address different security boundaries.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.