Sql Splitter

• Outcome: Review
• Latest audit: Jul 4, 2026 · 2:46 AM UTC
• Version: 3.6.3

Overview

This is mostly a SQL splitting and conversion tool, but it includes unsafe runtime code-patching and security-evasion guidance that users should review before installing.

Install only after reviewing the scripts you plan to run. Prefer the normal split_sql_v21.py or split_sql_v22.py paths, avoid unlimited_split.py unless you understand and accept its dynamic code execution, keep backups of SQL files, and review generated or converted SQL before running it against a database.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (12)

Dangerous chain: exec() wrapping compile

Critical

• Category: Dangerous Code Execution

Content

mod = types.ModuleType('v21_patched')
mod.__file__ = '<patched>'
exec(compile(source, '<patched>', 'exec'), mod.__dict__)
split_fn = mod.split_sql_file

# CLI

• Confidence: 98% confidence
• Finding: The script reads Python source from disk, rewrites it as text, then executes it with exec(compile(...)). This creates a code-injection and trust-boundary violation: any tampering with split_sql_v21.py or the expected scripts directory results in arbitrary code execution when this utility runs. In the context of a SQL splitter, dynamically executing patched source is unnecessary and substantially more dangerous than ordinary importing.

exec() call detected

High

• Category: Dangerous Code Execution

Content

mod = types.ModuleType('v21_patched')
mod.__file__ = '<patched>'
exec(compile(source, '<patched>', 'exec'), mod.__dict__)
split_fn = mod.split_sql_file

# CLI

• Confidence: 97% confidence
• Finding: The exec() call executes dynamically constructed code from a file that is modified at runtime. Because the executed code is not fixed in this script, an attacker who can alter the target file or influence the runtime environment can gain arbitrary code execution under the user's privileges. The skill's stated purpose does not justify this level of code execution capability.

compile() call detected

Medium

• Category: Dangerous Code Execution

Content

mod = types.ModuleType('v21_patched')
mod.__file__ = '<patched>'
exec(compile(source, '<patched>', 'exec'), mod.__dict__)
split_fn = mod.split_sql_file

# CLI

• Confidence: 92% confidence
• Finding: compile() is used here as part of a dynamic execution chain, turning mutable text into executable Python code. While compile() alone is not always unsafe, in this usage it directly enables arbitrary code execution from rewritten source and therefore contributes to the overall vulnerability. In this skill context, that capability is disproportionate to the advertised SQL-splitting function.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 84% confidence
• Finding: The manifest says the skill only splits SQL and analyzes dependencies, but the documentation shows materially broader behavior: SQL dialect conversion, GUI features, checkpoint persistence, config import/export, preview, batch processing, and filesystem modifications. This mismatch weakens trust boundaries and can cause users or platforms to grant the skill more operational latitude than they intended.

Description-Behavior Mismatch

Medium

• Confidence: 82% confidence
• Finding: The manifest omits substantial SQL Server-to-DM conversion and rewrite behavior that changes SQL semantics and produces additional output artifacts. Hidden or under-described transformation capability is dangerous because users may invoke the skill expecting passive splitting, while it actually performs content-rewriting that can affect correctness and downstream execution.

Description-Behavior Mismatch

Low

• Confidence: 82% confidence
• Finding: The manifest omits substantial SQL Server-to-DM conversion and rewrite behavior that changes SQL semantics and produces additional output artifacts. Hidden or under-described transformation capability is dangerous because users may invoke the skill expecting passive splitting, while it actually performs content-rewriting that can affect correctness and downstream execution.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The script advertises GUI, batch, preview, checkpoint, and config modes through imports, help text, and argument parsing, but at runtime all of those modes are forcibly disabled with a paywall message and immediate exit. In an agent skill context, this is dangerous because it creates a deceptive interface: orchestration code or users may rely on capabilities that never execute, causing security controls, validation flows, or expected processing paths to be silently bypassed.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The module header claims that v2.2 adds GUI, checkpointing, batch processing, preview, and configuration management, yet the executable path disables all of them. This documentation-to-behavior mismatch is a form of deceptive functionality that can mislead reviewers and automation into trusting features such as checkpointing or preview isolation that are not actually available.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script's core behavior is to read another Python file, patch it as raw text, and execute it. That introduces an unnecessary arbitrary-code-execution path and expands the skill's capabilities beyond SQL parsing into runtime code loading, making supply-chain or local file tampering significantly more dangerous. Because the skill is expected to process SQL files, not execute rewritten Python, the context makes this more concerning.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The documented `grep -v ... | xargs rm` workflow performs irreversible deletion of files in the output directory without strong safeguards. In a skill that processes user files, terse destructive shell examples increase the risk of accidental data loss, especially if run from the wrong directory or with unexpected filenames.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: The in-place `sed -i` example modifies the original SQL file directly and could corrupt source material if the pattern is wrong or the platform-specific syntax differs. Because this is presented as a quick fix, users may run it without understanding that it mutates input data irreversibly.

Ssd 2

Medium

• Confidence: 95% confidence
• Finding: The documentation explicitly advises rewriting execution into a temporary script to avoid security scanning of inline commands. Guidance framed as bypassing security controls is a major red flag because it normalizes evasion behavior and can be repurposed to hide unsafe operations from platform defenses.

Static analysis

No suspicious patterns detected.