Sql Splitter

• Outcome: Review
• Latest audit: Jul 4, 2026 · 2:46 AM UTC
• Version: 3.6.3

Overview

This is mostly a SQL splitting and conversion tool, but it includes unsafe runtime code-patching and security-evasion guidance that users should review before installing.

Install only after reviewing the scripts you plan to run. Prefer the normal split_sql_v21.py or split_sql_v22.py paths, avoid unlimited_split.py unless you understand and accept its dynamic code execution, keep backups of SQL files, and review generated or converted SQL before running it against a database.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (12)

Dangerous chain: exec() wrapping compile

Critical

• Category: Dangerous Code Execution

Content

mod = types.ModuleType('v21_patched')
mod.__file__ = '<patched>'
exec(compile(source, '<patched>', 'exec'), mod.__dict__)
split_fn = mod.split_sql_file

# CLI

• Confidence: 98% confidence
• Finding: exec(compile(source, '<patched>', 'exec'), mod.__dict__)

exec() call detected

High

• Category: Dangerous Code Execution

Content

mod = types.ModuleType('v21_patched')
mod.__file__ = '<patched>'
exec(compile(source, '<patched>', 'exec'), mod.__dict__)
split_fn = mod.split_sql_file

# CLI

• Confidence: 97% confidence
• Finding: exec(compile(source, '<patched>', 'exec'), mod.__dict__)

compile() call detected

Medium

• Category: Dangerous Code Execution

Content

mod = types.ModuleType('v21_patched')
mod.__file__ = '<patched>'
exec(compile(source, '<patched>', 'exec'), mod.__dict__)
split_fn = mod.split_sql_file

# CLI

• Confidence: 92% confidence
• Finding: exec(compile(source, '<patched>', 'exec'), mod.__dict__)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 84% confidence
• Finding: The manifest says the skill only splits SQL and analyzes dependencies, but the documentation shows materially broader behavior: SQL dialect conversion, GUI features, checkpoint persistence, config import/export, preview, batch processing, and filesystem modifications. This mismatch weakens trust boundaries and can cause users or platforms to grant the skill more operational latitude than they intended.

Description-Behavior Mismatch

Medium

• Confidence: 82% confidence
• Finding: The manifest omits substantial SQL Server-to-DM conversion and rewrite behavior that changes SQL semantics and produces additional output artifacts. Hidden or under-described transformation capability is dangerous because users may invoke the skill expecting passive splitting, while it actually performs content-rewriting that can affect correctness and downstream execution.

Description-Behavior Mismatch

Low

• Confidence: 82% confidence
• Finding: The manifest omits substantial SQL Server-to-DM conversion and rewrite behavior that changes SQL semantics and produces additional output artifacts. Hidden or under-described transformation capability is dangerous because users may invoke the skill expecting passive splitting, while it actually performs content-rewriting that can affect correctness and downstream execution.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The script advertises GUI, batch, preview, checkpoint, and config modes through imports, help text, and argument parsing, but at runtime all of those modes are forcibly disabled with a paywall message and immediate exit. In an agent skill context, this is dangerous because it creates a deceptive interface: orchestration code or users may rely on capabilities that never execute, causing security controls, validation flows, or expected processing paths to be silently bypassed.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The module header claims that v2.2 adds GUI, checkpointing, batch processing, preview, and configuration management, yet the executable path disables all of them. This documentation-to-behavior mismatch is a form of deceptive functionality that can mislead reviewers and automation into trusting features such as checkpointing or preview isolation that are not actually available.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script's core behavior is to read another Python file, patch it as raw text, and execute it. That introduces an unnecessary arbitrary-code-execution path and expands the skill's capabilities beyond SQL parsing into runtime code loading, making supply-chain or local file tampering significantly more dangerous. Because the skill is expected to process SQL files, not execute rewritten Python, the context makes this more concerning.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The documented `grep -v ... | xargs rm` workflow performs irreversible deletion of files in the output directory without strong safeguards. In a skill that processes user files, terse destructive shell examples increase the risk of accidental data loss, especially if run from the wrong directory or with unexpected filenames.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: The in-place `sed -i` example modifies the original SQL file directly and could corrupt source material if the pattern is wrong or the platform-specific syntax differs. Because this is presented as a quick fix, users may run it without understanding that it mutates input data irreversibly.

Ssd 2

Medium

• Confidence: 95% confidence
• Finding: The documentation explicitly advises rewriting execution into a temporary script to avoid security scanning of inline commands. Guidance framed as bypassing security controls is a major red flag because it normalizes evasion behavior and can be repurposed to hide unsafe operations from platform defenses.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.