Sql Splitter

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:29 AM UTC
• Version: 3.6.3

Overview

The skill mostly matches SQL splitting and conversion, but it includes a helper that dynamically patches and executes code from a hardcoded external skill path while bypassing limits.

Review before installing. Use the normal packaged splitter/converter paths only, avoid scripts/unlimited_split.py, and do not let the skill operate on broad or sensitive directories until the dynamic exec helper and config-name path traversal are removed or constrained.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T07 · Tool Hijacking and Spoofing

Error

• Location: scripts/unlimited_split.py:20

Finding

Runtime Patching and Dynamic Execution Bypass Tool Restrictions

Content

View full analysis

' exec(compile(source, '', 'exec'), mod.__dict__) split_fn = mod.split_sql_file ``` ### Technical Analysis The script reads the source of another locally installed SQL splitter from a hardcoded path, changes its object-count and file-size limits, compiles the modified source, and executes it as a fabricated module. This behavior is explicitly intended to bypass community-edition restrictions. It is not necessary to perform ordinary SQL splitting or conversion. It also violates the trust boundary between the audited package and another installed tool: the effective code executed by this script is not limited to code contained in the audited artifact. The use of: ```python exec(compile(s ...[truncated 2375 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/config_manager.py:105

Finding

Configuration Name Path Traversal Enables File Overwrite and Deletion

Content

View full analysis

Path: """ 获取配置文件路径 Args: name: 配置名称 Returns: 配置文件路径 """ return self.config_dir / f"{name}.json" ``` The resulting path is used as a write destination: ```python def save_config(self, config: SplitConfig, name: str = "default") -> bool: try: config_file = self.get_config_file(name) # 验证配置 errors = config.validate() if errors: print(f"配置验证失败: {', '.join(errors)}") return False # 保存配置 with open(config_file, 'w', encoding='utf-8') as f: json.dump(config.to_dict(), f, indent=2, ensure_ascii=False) return True except Exception as e: print(f"保存配置失败: {e}") return False ``` The same path is also used as a deletion target: ```python def delete_config(self, name: str) -> bool: """ 删除配置 Args: name: 配置名称 Returns: 是否删除成功 """ try: config_file = self.get_config_file(name) if config_file.exists(): config_file.unlink() return True except Exception as e: print(f"删除配置失败: {e}") return False ``` ### Technical Analysis `get_config_file()` does not restrict `name` to a simple filename. A name containing an absolute path or parent-directory components can escape the intended `~/.sql_splitter_configs` directory. For example: ```text ../../target ``` produces a path ending in: ```text ~/.sql_splitter_configs/../../target.json ``` An absolute configuration name is also dangerous because `pathlib` discards the preceding base path when its right-hand operand is absolute. The aff ...[truncated 2199 chars]

Remediation

View remediation

None: if not _CONFIG_NAME.fullmatch(name): raise ValueError("Invalid configuration name") ``` 2. Canonicalize and verify the final path before every read, write, or deletion: ```python def get_config_file(self, name: str) -> Path: validate_config_name(name) base = self.config_dir.resolve() candidate = (base / f"{name}.json").resolve() try: candidate.relative_to(base) except ValueError: raise ValueError("Configuration path escapes the configuration directory") return candidate ``` 3. Explicitly reject: - Absolute paths. - `/` and `\` separators. - `.` and `..` path components. - Empty names. - Control characters and null bytes. 4. Apply the same validation to `save_config()`, `load_config()`, `delete_config()`, and `import_config()`. 5. Avoid following symbolic links when opening sensitive configuration targets where the platform permits it. 6. Use atomic writes through a securely created temporary file in the same validated directory, followed by an atomic replacement. 7. Set restrictive permissions on the configuration directory and files. 8. Add regression tests for absolute paths, traversal sequences, mixed separators, symbolic links, and encoded traversal variants. 9. Validate CLI arguments even if the configuration feature is currently disabled, so future re-enablement does not expose the vulnerable API. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (66)

Dangerous chain: exec() wrapping compile

Critical

• Category: Dangerous Code Execution
• Confidence: 98% confidence

Finding

The script reads Python source from a local file, rewrites it as text, then executes the modified code via compile+exec. Any compromise of split_sql_v21.py or the searched path results in arbitrary code execution with the user's privileges, and dynamic source patching defeats normal review and supply-chain trust boundaries.

Content

Scanner excerpt · scripts/unlimited_split.py (reported line 44)May include surrounding context.

python

mod = types.ModuleType('v21_patched')
mod.__file__ = '<patched>'
exec(compile(source, '<patched>', 'exec'), mod.__dict__)
split_fn = mod.split_sql_file

# CLI

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The manifest and top-level description present the skill primarily as a SQL splitter, while the documentation shows substantial additional behavior including SQL Server→DM conversion, batch processing, config handling, checkpointing, GUI features, and file mutation workflows. Scope mismatch is dangerous because users and policy systems may approve a lower-risk file utility while the skill actually performs broader transformations and persistence-related operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The manifest and top-level description present the skill primarily as a SQL splitter, while the documentation shows substantial additional behavior including SQL Server→DM conversion, batch processing, config handling, checkpointing, GUI features, and file mutation workflows. Scope mismatch is dangerous because users and policy systems may approve a lower-risk file utility while the skill actually performs broader transformations and persistence-related operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The manifest and top-level description present the skill primarily as a SQL splitter, while the documentation shows substantial additional behavior including SQL Server→DM conversion, batch processing, config handling, checkpointing, GUI features, and file mutation workflows. Scope mismatch is dangerous because users and policy systems may approve a lower-risk file utility while the skill actually performs broader transformations and persistence-related operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The manifest and top-level description present the skill primarily as a SQL splitter, while the documentation shows substantial additional behavior including SQL Server→DM conversion, batch processing, config handling, checkpointing, GUI features, and file mutation workflows. Scope mismatch is dangerous because users and policy systems may approve a lower-risk file utility while the skill actually performs broader transformations and persistence-related operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The manifest and top-level description present the skill primarily as a SQL splitter, while the documentation shows substantial additional behavior including SQL Server→DM conversion, batch processing, config handling, checkpointing, GUI features, and file mutation workflows. Scope mismatch is dangerous because users and policy systems may approve a lower-risk file utility while the skill actually performs broader transformations and persistence-related operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The manifest and top-level description present the skill primarily as a SQL splitter, while the documentation shows substantial additional behavior including SQL Server→DM conversion, batch processing, config handling, checkpointing, GUI features, and file mutation workflows. Scope mismatch is dangerous because users and policy systems may approve a lower-risk file utility while the skill actually performs broader transformations and persistence-related operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The manifest and top-level description present the skill primarily as a SQL splitter, while the documentation shows substantial additional behavior including SQL Server→DM conversion, batch processing, config handling, checkpointing, GUI features, and file mutation workflows. Scope mismatch is dangerous because users and policy systems may approve a lower-risk file utility while the skill actually performs broader transformations and persistence-related operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The manifest and top-level description present the skill primarily as a SQL splitter, while the documentation shows substantial additional behavior including SQL Server→DM conversion, batch processing, config handling, checkpointing, GUI features, and file mutation workflows. Scope mismatch is dangerous because users and policy systems may approve a lower-risk file utility while the skill actually performs broader transformations and persistence-related operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The manifest and top-level description present the skill primarily as a SQL splitter, while the documentation shows substantial additional behavior including SQL Server→DM conversion, batch processing, config handling, checkpointing, GUI features, and file mutation workflows. Scope mismatch is dangerous because users and policy systems may approve a lower-risk file utility while the skill actually performs broader transformations and persistence-related operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The manifest and top-level description present the skill primarily as a SQL splitter, while the documentation shows substantial additional behavior including SQL Server→DM conversion, batch processing, config handling, checkpointing, GUI features, and file mutation workflows. Scope mismatch is dangerous because users and policy systems may approve a lower-risk file utility while the skill actually performs broader transformations and persistence-related operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The manifest and top-level description present the skill primarily as a SQL splitter, while the documentation shows substantial additional behavior including SQL Server→DM conversion, batch processing, config handling, checkpointing, GUI features, and file mutation workflows. Scope mismatch is dangerous because users and policy systems may approve a lower-risk file utility while the skill actually performs broader transformations and persistence-related operations.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

md

- **schema_prefix传参链路断裂** — `split_sql_v21.py`的`_convert_split_output()`函数签名有schema_prefix参数，但调用处(第886行)没传，convert调用(第977行)也没传，导致dbo替换永远不生效。修复：调用链全程传递schema_pre

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 825)May include surrounding context.

md

- 提取 `common.py` 共享模块：SQLDialect 枚举、对象前缀、类型优先级、关键字表

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The manifest says the skill splits SQL files into independent files for procedures, functions, views, triggers, tables, indexes, and constraints, and analyzes dependencies to generate merge scripts. This file instead implements a large SQL Server-to-Dameng syntax converter, with object/type/function rewrites and no file-splitting, dependency analysis, or merge-script generation logic.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script modifies local source code and executes it dynamically, which is disproportionate to the stated SQL-splitting task and creates a strong arbitrary-code-execution primitive. In agent-skill context this is more dangerous because skills are expected to be narrow-purpose utilities, and this one instead alters and runs other code at runtime.

Content

No source excerpt is available for this finding.

exec() call detected

High

• Category: Dangerous Code Execution
• Confidence: 97% confidence

Finding

The exec() call executes code built from a mutable source string loaded from disk. In this skill, exec is not processing fixed internal bytecode but a patched file body, so a tampered dependency or path hijack becomes immediate arbitrary code execution.

Content

Scanner excerpt · scripts/unlimited_split.py (reported line 44)May include surrounding context.

python

mod = types.ModuleType('v21_patched')
mod.__file__ = '<patched>'
exec(compile(source, '<patched>', 'exec'), mod.__dict__)
split_fn = mod.split_sql_file

# CLI

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill documents file read/write behavior but declares no explicit tool scope or permission boundaries. In an agent setting, missing scope increases the chance of unintended access to arbitrary files because the runtime and user cannot easily constrain what the skill is allowed to read or modify.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documented behavior materially exceeds the declared purpose by including dialect conversion and report generation. This can undermine human review and automated policy enforcement because the visible contract of the skill understates what it can do to user files and outputs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This markdown file presents the skill name/description and primary usage guidance in Chinese, effectively forcing a specific language on users without any opt-in or alternative locale. The policy for SQP-3 applies to natural-language content in all file types, and there is no indication that this is a region-specific or Chinese-only tool.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documented workflow includes destructive deletion commands (rm, filtered deletion) without a prominent irreversible-data-loss warning or safer alternatives. In an agent-operated environment, examples like this can cause accidental mass deletion of files if paths or filters are wrong.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

At L0349 and again at L0875, the documentation states that v21 does not support the --convert-to parameter. This directly contradicts earlier documentation that says split_sql_v21.py added convert_to support and automatic post-split conversion, creating a clear intent/documentation inconsistency within the skill file.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 62% confidence

Finding

The skill documents checkpointing/config management and persistent state behaviors, which can create session persistence risks if prior run metadata is reused across tasks without clear isolation. In multi-user or agent contexts, persisted state can leak paths, filenames, or workflow assumptions into later sessions.

Content

Scanner excerpt · SKILL.md (reported line 787)May include surrounding context.

md

- 支持 IF...THEN...END IF、CASE...END CASE、LOOP...END LOOP 嵌套

- 不再依赖"下一个 CREATE 位置"做上界，**正确处理过程体内的嵌套 CREATE 语句**

- Oracle/DM: 通过 `/` 终止符定位；SQL Server: 通过 `GO` 定位

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file is entirely written in Chinese, including the title and all operational guidance, with no indication that the user may choose another language or that the skill is region-specific. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file contains user-facing natural-language content exclusively in Chinese, and there is no indication that the skill or documentation supports user language choice. Under the policy rule for language/locale violations, forcing a specific language without opt-in can be a natural-language policy issue.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.