DBCheck 数据库巡检

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:40 AM UTC
• Version: 2.6.2

Overview

DBCheck is a real database inspection skill, but it handles database and SSH credentials and can expose sensitive infrastructure details in ways that are broader and less clearly disclosed than users are told.

Install only if you are comfortable granting this skill access to database credentials and possibly SSH credentials. Use least-privileged read-only database accounts, avoid passing passwords on the command line, do not use SSH password auth with unknown hosts, keep generated reports/history private, and leave online AI disabled unless you have reviewed the destination and payload.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/run_inspection.py:801
• Finding: Database and SSH credentials are exposed through command-line arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:170-312`; `scripts/run_inspection.py:801-820, 908-923` **Vulnerability Type**: Sensitive credentials in process arguments **Risk Level**: High ### Vulnerable Code The Skill instructs the Agent to place database passwords directly on the command line: ```bash python run_inspection.py \ --type mysql \ --host <database-IP> \ --port 3306 \ --user <username> \ --password <password> \ --label "<database-label>" \ --inspector "<inspector-name>" ``` The dispatcher also accepts database and SSH credentials as ordinary command-line arguments: ```python parser.add_argument('--user', help='Database username') parser.add_argument('--password', help='Database password') parser.add_argument('--ssh-user', default=None, help='SSH username (optional)') parser.add_argument('--ssh-password', default=None, help='SSH password (optional)') parser.add_argument('--ssh-key', default=None, help='SSH private-key path (optional, alternative to password)') ``` The parsed values are then retained in process memory: ```python db_info = { 'label': args.label, 'host': args.host, 'port': args.port, 'user': args.user, 'password': args.password, } if args.ssh_host: ssh_info = { 'ssh_host': args.ssh_host, 'ssh_port': args.ssh_port, 'ssh_user': args.ssh_user, 'ssh_password': args.ssh_password or '', 'ssh_key_file': args.ssh_key or '', } ``` ### Technical Analysis On common operating systems, process arguments are not a secure secret-delivery mechanism. Depending on the platform and host configuration, they may be exposed through: - Process-listing utilities such as `ps`; - `/proc/<pid>/cmdline` on Linux; - Shell history; - Process accounting or endpoint monitoring; - Agent execution transcripts and orchestration logs; - Error reports that capture the invoked command. The same problem ...[truncated 1421 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `--password` and `--ssh-password` from the recommended invocation flow. 2. Read passwords interactively with `getpass.getpass()` when attached to a terminal. 3. For automated operation, accept secrets through: - A protected file descriptor; - Standard input with explicit non-logging handling; - An operating-system credential store; - A secret manager; - A short-lived credential token. 4. If environment variables must be supported for compatibility, document that they may still be visible to same-user processes and must not be logged. 5. Ensure Agent integrations pass secrets through a dedicated secret field rather than embedding them in an `execute_command` string. 6. Redact arguments named `password`, `ssh-password`, `token`, and `api-key` in execution logs and exception telemetry. 7. Prefer short-lived, read-only database accounts created specifically for inspection. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/main_mysql.py:270
• Finding: SSH connections automatically trust unknown host keys<![CDATA[ ## Vulnerability Details **File Location**: `scripts/main_mysql.py:270-324`; equivalent behavior is present in the PostgreSQL, TiDB, DM8, IvorySQL, and SQL Server collectors **Vulnerability Type**: Missing SSH server identity verification **Risk Level**: High ### Vulnerable Code ```python def connect(self): """ Establish an SSH connection. Private-key authentication is preferred; otherwise password authentication is used. Unknown remote host keys are accepted automatically. """ try: self.ssh_client = paramiko.SSHClient() self.ssh_client.set_missing_host_key_policy(paramiko.AutoAddPolicy()) if self.key_file: private_key = paramiko.RSAKey.from_private_key_file(self.key_file) self.ssh_client.connect( hostname=self.host, port=self.port, username=self.username, pkey=private_key, timeout=10 ) else: self.ssh_client.connect( hostname=self.host, port=self.port, username=self.username, password=self.password, timeout=10 ) return True except Exception as e: print(_t("mysql_cli_remote_ssh_fail").format( host=self.host, port=self.port, e=e )) return False ``` ### Technical Analysis `paramiko.AutoAddPolicy()` accepts and stores an unknown SSH server key without requiring prior trust or user confirmation. This removes the principal SSH control that authenticates the server. Encryption alone does not protect the session when the client cannot verify which server it is communicating with. A network-positioned attacker can present an attacker-controlled host key and be accepted as the requested host. For password authentication, the client then supplies the password to the impersonating SSH endpoint. For key authentication, the private key itse ...[truncated 1426 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `AutoAddPolicy` with `paramiko.RejectPolicy()`. 2. Load trusted keys before connecting: ```python client = paramiko.SSHClient() client.load_system_host_keys() client.set_missing_host_key_policy(paramiko.RejectPolicy()) ``` 3. Support explicit SHA-256 host-key fingerprint pinning in the inspection configuration. 4. For first use, display the fingerprint through a trusted interface and require explicit operator confirmation. 5. Store accepted host keys in a permission-restricted, application-specific known-hosts file. 6. Detect and reject host-key changes rather than silently replacing trusted identity data. 7. Avoid defaulting the SSH username to `root`; require an explicit, least-privileged account. 8. Use a restricted SSH account authorized only to execute the read-only commands required for inspection. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/main_oracle_full.py:401
• Finding: Oracle inspection collects excessive host, account, network, and scheduled-task metadata<![CDATA[ ## Vulnerability Details **File Location**: `scripts/main_oracle_full.py:401-487` **Vulnerability Type**: Excessive system reconnaissance and violation of least privilege **Risk Level**: Medium ### Vulnerable Code ```python def run_cmd(self, cmd): """Execute a command through SSH or locally.""" if self.ssh: try: stdin, stdout, stderr = self.ssh.exec_command(cmd) return stdout.read().decode('utf-8', errors='ignore') except Exception: return "" else: import subprocess try: return subprocess.check_output( cmd, shell=True, stderr=subprocess.DEVNULL, timeout=30 ).decode('utf-8', errors='ignore') except Exception: return "" ``` The default collection includes sensitive host metadata beyond ordinary CPU, memory, and disk metrics: ```python # /etc/hosts data['hosts'] = self.run_cmd( "sed '1,2d' /etc/hosts 2>/dev/null | grep -v '^$'" ).strip() # sysctl parameters data['sysctl'] = self.run_cmd( "grep -E 'kernel.shmall|kernel.shmmax|kernel.sem|kernel.shmmni|" "fs.aio-max-nr|fs.file-max|vm.swappiness|vm.nr_hugepages' " "/etc/sysctl.conf 2>/dev/null" ).strip() # limits.conf data['limits'] = self.run_cmd( "grep -v '^#\\|^$' /etc/security/limits.conf 2>/dev/null" ).strip() # crontab data['crontab'] = self.run_cmd("crontab -l 2>/dev/null").strip() # network data['network'] = self.run_cmd( "ip addr show 2>/dev/null | grep 'inet '" ).strip() # /etc/passwd data['oracle_users'] = self.run_cmd( "grep -E '^(oracle|grid|root):' /etc/passwd 2>/dev/null" ).strip() ``` ### Technical Analysis CPU, memory, disk utilization, and selected Oracle kernel parameters are reasonably related to database health inspection. However, collecting all of the following by default exceeds the minimum information needed for that function: - Non-default `/etc/hosts` mappin ...[truncated 2138 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make operating-system collection a separate, explicit option disabled by default. 2. Split collection into granular consent categories: - Performance metrics; - Kernel parameters; - Network metadata; - Account metadata; - Scheduled tasks. 3. Do not collect `/etc/hosts`, `/etc/passwd`, or crontab data during a standard health check. 4. If a compliance mode requires these values, collect only specific fields and redact: - Password hash placeholders; - Home directories; - Internal addresses; - Command arguments containing secrets; - Sensitive paths. 5. Clearly list every collected file and command before asking the user to enable OS-level inspection. 6. Use a dedicated, non-root SSH account with a restricted command allowlist. 7. Replace `shell=True` with fixed argument arrays or narrowly scoped parsing implemented in Python. 8. Apply restrictive permissions to reports and history files and define an explicit retention policy. ]]>

other

Warning

• Location: scripts/analyzer.py:1323
• Finding: Optional online AI analysis can transmit database and host information to unrestricted external endpoints<![CDATA[ ## Vulnerability Details **File Location**: `scripts/analyzer.py:1323-1376, 1580-1665, 1709-1734`; conflicting disclosure in `SKILL.md:17-22` and `security.md:41-47` **Vulnerability Type**: Externally transmitted inspection data without adequate disclosure and endpoint restriction **Risk Level**: Medium ### Vulnerable Code Online mode accepts an unrestricted configured API URL: ```python _online_enabled = False _online_api_url = 'https://api.openai.com/v1' _cfg_path = _os.path.join( _os.path.dirname(_os.path.abspath(__file__)), 'dbc_config.json' ) if _os.path.exists(_cfg_path): with open(_cfg_path, 'r', encoding='utf-8') as _f: _full_cfg = _json.load(_f) _cfg = _full_cfg.get('ai', {}) _online_enabled = _cfg.get('online_enabled', False) _online_api_url = _cfg.get( 'online_api_url', 'https://api.openai.com/v1' ) ``` The local backend is restricted to loopback, but the online backend is intentionally unrestricted: ```python if self.backend == 'ollama': if not _is_localhost_url(resolved_url): self.backend = 'disabled' elif self.backend == 'openai': if not api_url: resolved_url = _online_api_url or 'https://api.openai.com/v1' ``` The transmitted prompt can contain host and database metrics, risks, and SQL excerpts: ```python metrics['slow_query_top3'] = '\n'.join([ f" - latency={x.get('total_time_sec', 0):.3f}s, " f"exec={x.get('exec_count', 0)}, " f"scan={x.get('rows_scanned', 0)}, " f"sql={x.get('query_text', '')[:100]}" for x in top3 ]) ``` The prompt is sent to the configured endpoint: ```python payload = _json.dumps({ 'model': self.model, 'messages': [ {'role': 'user', 'content': prompt} ], 'temperature': 0.3, }).encode('utf-8') req = urllib.request.Request(url, data=payload, method='POST') req.add_header('Content-Type', 'application/json') if self.api_key: req.add_header('Authorization', f'Bearer {self.api_key}') wi ...[truncated 2451 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Update `SKILL.md` and `security.md` to describe online AI transmission accurately. 2. Before every first online use, display: - The destination hostname; - The categories of data being sent; - Whether SQL text is included; - The provider’s likely retention implications. 3. Require explicit user consent rather than relying only on a configuration flag. 4. Show a redacted payload preview before transmission. 5. Remove SQL literals and comments through a SQL-aware redaction routine; preferably transmit normalized query fingerprints instead of query text. 6. Redact hostnames, labels, IP addresses, usernames, database names, schemas, and table names by default. 7. Require HTTPS and reject plain HTTP for non-loopback endpoints. 8. Implement an administrator-controlled endpoint allowlist. 9. Protect AI configuration files with restrictive permissions and never persist API keys in plaintext where avoidable. 10. Provide a strict local-only mode that cannot be overridden by ordinary project configuration. ]]>

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:5
• Finding: Dependencies are installed with broad lower-bound constraints and without integrity pinning<![CDATA[ ## Vulnerability Details **File Location**: `requirements.txt:5-37`; installation guidance in `SKILL.md:157-163` **Vulnerability Type**: Unpinned third-party dependency supply chain **Risk Level**: Medium ### Vulnerable Code ```text python-docx>=0.8.10 docxtpl>=0.16.0 psutil>=5.9.0 PyYAML>=6.0.0 cryptography>=41.0.0 flask>=2.0.0 flask-socketio>=5.0.0 pymysql>=1.0.0 psycopg2-binary>=2.9.0 oracledb>=1.4.0 dmpython>=1.0.0 pyodbc>=4.0.0 paramiko>=2.10.0 openpyxl>=3.0.0 pandas>=1.3.0 reportlab>=4.0.0 apscheduler>=3.10.0 PyPDF2>=3.0.1 ``` The Skill also recommends an unconstrained direct installation: ```bash pip install pymysql psycopg2-binary paramiko openpyxl docxtpl \ python-docx pandas psutil flask oracledb dmpython pyodbc \ flask-socketio jaydebeapi ``` ### Technical Analysis Nearly all dependencies use lower-bound constraints (`>=`) rather than exact versions. The resulting environment depends on whichever package versions are newest when installation occurs. There are also no package hashes, signed lockfile, or documented package-index restrictions. This creates several risks: - A future compromised release may be selected automatically; - Breaking changes may alter security behavior; - Dependency resolution can vary between installations; - A malicious or misconfigured package index may supply an unexpected artifact; - Optional drivers and web components are installed even when they are unnecessary for the selected inspection mode. No known malicious package or typosquatted dependency was confirmed in the reviewed list. The issue is the absence of reproducible and integrity-verified dependency resolution, not proof that the current packages are malicious. The local YashanDB wheel reference is explicit: ```text yasdb@ file:./drivers/yashandb/yasdb-1.2.0-py3-none-any.whl ``` However, its integrity is not pinned by a cryptographic hash. ### Attack Path 1. A user follows the Skill instructions and executes the broad `pip instal ...[truncated 994 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create a reviewed lockfile with exact versions for direct and transitive dependencies. 2. Generate and verify SHA-256 hashes, for example with `pip-compile --generate-hashes`. 3. Install with hash enforcement: ```bash pip install --require-hashes -r requirements.lock ``` 4. Pin the local YashanDB wheel with a separately published and verified SHA-256 digest. 5. Separate dependencies into minimal extras such as: - `dbcheck[mysql]`; - `dbcheck[postgresql]`; - `dbcheck[oracle]`; - `dbcheck[web]`; - `dbcheck[pdf]`. 6. Do not install Web UI, scheduler, SSH, or unrelated database drivers unless the selected feature requires them. 7. Use a dedicated virtual environment and avoid administrator-level package installation. 8. Restrict installations to a trusted index or internal artifact repository. 9. Add automated vulnerability, provenance, and license scanning to the release process. 10. Define a controlled update process so pinned dependencies can still receive reviewed security patches. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration

Findings (143)

Tainted flow: 'cmd' from input (line 248, user input) → subprocess.run (code execution)

Critical

• Category: Data Flow

Content

cmd = [sys.executable, script, '--check-config',
               '--host', host, '--port', port or ('3306' if db_type == 'mysql' else '5432'),
               '--user', user, '--password', password, '--label', label]
        subprocess.run(cmd)
    except Exception as e:
        print(f"\n{t('cli.config_baseline_error')}: {e}")

• Confidence: 90% confidence
• Finding: External input (network, user) flows to a code execution sink. This enables remote code execution or command injection.

Tainted flow: 'cmd' from input (line 248, user input) → subprocess.run (code execution)

Critical

• Category: Data Flow

Content

cmd = [sys.executable, script, '--check-config',
               '--host', host, '--port', port or ('3306' if db_type == 'mysql' else '5432'),
               '--user', user, '--password', password, '--label', label]
        subprocess.run(cmd)
    except Exception as e:
        print(f"\n{t('cli.config_baseline_error')}: {e}")

• Confidence: 90% confidence
• Finding: External input (network, user) flows to a code execution sink. This enables remote code execution or command injection.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: Undisclosed SSH connectivity, remote command execution, host information collection, bulk credential handling, and possible AI/external service integration materially expand the attack surface beyond simple database health checks. In context, this is especially risky because users are instructed to provide privileged database and possibly SSH credentials, so hidden or under-disclosed behaviors can expose highly sensitive infrastructure data.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: Undisclosed SSH connectivity, remote command execution, host information collection, bulk credential handling, and possible AI/external service integration materially expand the attack surface beyond simple database health checks. In context, this is especially risky because users are instructed to provide privileged database and possibly SSH credentials, so hidden or under-disclosed behaviors can expose highly sensitive infrastructure data.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: Undisclosed SSH connectivity, remote command execution, host information collection, bulk credential handling, and possible AI/external service integration materially expand the attack surface beyond simple database health checks. In context, this is especially risky because users are instructed to provide privileged database and possibly SSH credentials, so hidden or under-disclosed behaviors can expose highly sensitive infrastructure data.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: Undisclosed SSH connectivity, remote command execution, host information collection, bulk credential handling, and possible AI/external service integration materially expand the attack surface beyond simple database health checks. In context, this is especially risky because users are instructed to provide privileged database and possibly SSH credentials, so hidden or under-disclosed behaviors can expose highly sensitive infrastructure data.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The module-level security note states that AI diagnostics only support local Ollama and do not send data to third parties, but the implementation later supports remote OpenAI-compatible endpoints when online mode is enabled. This is dangerous because operators may rely on the documented safety guarantees and unknowingly allow sensitive database inspection data to be transmitted off-host.

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

## Overall Assessment

[One-sentence overall assessment]"""
        return prompt

    def diagnose(self, db_type: str, label: str, context: dict, issues: list,
                 timeout: int = 30, lang: str = 'zh') -> str:

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The run_full_analysis docstring claims AI configuration only supports local Ollama and that all data stays local, yet the code can instantiate an openai backend and send prompts to remote endpoints. This misleading contract can cause unintentional data disclosure during a database health check, especially because the function is a high-level entry point likely used by other components without deeper review.

Credential Access

High

• Category: Privilege Escalation

Content

"webui.placeholder_username": "Enter username",
    "webui.placeholder_service": "ORCL or orcl.example.com (leave empty to use host address)",
    "webui.placeholder_ssh_host": "Same as database host",
    "webui.placeholder_ssh_key": "/root/.ssh/id_rsa",
    "webui.placeholder_ssh_password": "SSH password",
    "webui.report_done_title": "Report Generated",
    "webui.reports_load_fail_detail": "Failed to load",

• Confidence: 90% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

"webui.placeholder_username": "Enter username",
    "webui.placeholder_service": "ORCL or orcl.example.com (leave empty to use host address)",
    "webui.placeholder_ssh_host": "Same as database host",
    "webui.placeholder_ssh_key": "/root/.ssh/id_rsa",
    "webui.placeholder_ssh_password": "SSH password",
    "webui.report_done_title": "Report Generated",
    "webui.reports_load_fail_detail": "Failed to load",

• Confidence: 90% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: This code sends the collected inspection context and auto-analysis results to an external AI backend without a clear, specific disclosure in the execution flow. Because the context may contain database inventory, user/security details, host information, and operational findings, silent exfiltration to a third party is a serious confidentiality issue.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The slow-query analysis integrates an AI advisor and can transmit query-analysis context without a clear warning, which is especially dangerous because SQL text often contains sensitive identifiers and sometimes embedded literals. In enterprise database tooling, this kind of undisclosed outbound sharing can create compliance, privacy, and data-leakage exposure.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code loads AI backend configuration and sends the collected inspection context to an external AI advisor. That context can contain database metadata, process lists, usernames, hostnames, platform details, and operational state, so this creates a significant data exfiltration/privacy risk that is not necessary for core local health inspection.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: At the AI diagnostic call site, the code may transmit the full inspection context to an external API without a prominent runtime warning or confirmation. In a DBA/ops tool, users may reasonably expect local-only analysis, so silent network egress of operational data materially increases confidentiality and compliance risk.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The slow-query analysis path also reuses the AI advisor, potentially transmitting deeper operational and SQL-related diagnostic context to an external service. Slow-query data can reveal schema details, business logic, table names, and sensitive query patterns, increasing confidentiality risk beyond what users may expect from a health-check report tool.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

else:
            import subprocess
            try:
                return subprocess.check_output(cmd, shell=True, stderr=subprocess.DEVNULL, timeout=30).decode('utf-8', errors='ignore')
            except Exception:
                return ""

• Confidence: 92% confidence
• Finding: Using a general shell execution helper with shell=True creates a powerful primitive that can be abused if any future or indirect caller passes user-controlled input. In a tool that accepts connection parameters and may evolve, this pattern is risky because a small change elsewhere can become full command execution on the host.

Credential Access

High

• Category: Privilege Escalation

Content

# 网络
        data['network'] = self.run_cmd("ip addr show 2>/dev/null | grep 'inet '").strip()

        # /etc/passwd（数据库用户检查用）
        data['oracle_users'] = self.run_cmd(
            "grep -E '^(oracle|grid|root):' /etc/passwd 2>/dev/null"
        ).strip()

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# 网络
        data['network'] = self.run_cmd("ip addr show 2>/dev/null | grep 'inet '").strip()

        # /etc/passwd（数据库用户检查用）
        data['oracle_users'] = self.run_cmd(
            "grep -E '^(oracle|grid|root):' /etc/passwd 2>/dev/null"
        ).strip()

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code establishes SSH connections to remote hosts and executes shell commands such as top, free, df, uname, and hostname, which is materially broader than simple database inspection. In a skill context, undisclosed remote command execution significantly increases trust requirements and can expose infrastructure details or enable misuse if pointed at unintended systems.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The AI diagnostic step loads external backend configuration and passes the collected inspection data and issues to an AI advisor for diagnosis. Because the inspection data includes database and possibly host-level details, this creates a data exfiltration risk when the manifest does not clearly disclose outbound transmission to a third-party service.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The AI diagnosis call may send collected database and host inspection data to an external service without prominent disclosure or consent at the point of use. In a DBA-oriented inspection tool, such data can contain sensitive infrastructure metadata, query text, backup paths, and operational details that should not leave the environment by default.

External Script Fetching

High

• Category: Supply Chain

Content

| ClawHavoc Attack Pattern | DBCheck Reality |
|---------------------------|-----------------|
| `curl ... | bash` (remote code download) | None — all code is bundled locally |
| Reads `~/.ssh/`, `~/.aws/credentials` | No — only connects to user-specified DB |
| Sends data to remote C2 server | No — no network exfiltration whatsoever |
| Modifies startup items / crontab | No — read-only health inspection |

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Credential Access

High

• Category: Privilege Escalation

Content

| ClawHavoc Attack Pattern | DBCheck Reality |
|---------------------------|-----------------|
| `curl ... | bash` (remote code download) | None — all code is bundled locally |
| Reads `~/.ssh/`, `~/.aws/credentials` | No — only connects to user-specified DB |
| Sends data to remote C2 server | No — no network exfiltration whatsoever |
| Modifies startup items / crontab | No — read-only health inspection |
| Uses `eval`/`exec` on obfuscated strings | No — Base64 used only for local password encryption in config |

• Confidence: 90% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README repeatedly highlights that each finding includes '修复 SQL（可直接复制执行）' and '每条风险附可执行的修复 SQL', but it does not prominently warn that these statements may modify database state and should be reviewed, tested, and approved before use. In a database-administration context, operators may over-trust generated SQL and apply it directly to production, leading to configuration drift, outages, privilege changes, or data integrity issues if a recommendation is unsafe or mismatched to the environment.

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.exposed_secret_literal

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/run_inspection.py:120

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/main_dm.py:973

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/main_ivorysql.py:288

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/main_mysql.py:300

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/main_pg.py:283

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/main_sqlserver.py:1115

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/main_tidb.py:317