Security audit

DBCheck 数据库巡检

Security checks across malware telemetry and agentic risk

Overview

DBCheck appears to be a legitimate database inspection tool, but it handles sensitive database and SSH data and has under-disclosed paths for remote AI analysis, so users should review it carefully before installing.

Install only if you are comfortable giving the skill database credentials and, if enabled, SSH access to target hosts. Prefer read-only database accounts, avoid command-line password flags where possible, do not enable online/OpenAI-compatible AI analysis unless the data is approved to leave your environment, bind any Web UI to localhost, and review generated repair SQL before running it in production.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (61)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The skill clearly instructs use of shell execution, local file writes, network/database access, and likely environment-dependent behavior, yet no explicit permissions are declared. This weakens least-privilege controls and increases the chance the skill is granted broader runtime capabilities than users or the platform expect.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The documentation presents the skill as a local database health-check/report tool, but the analyzed behavior includes additional persistence, broader analysis features, and optional remote AI/API functionality not reflected in the declared purpose. This kind of description-behavior mismatch undermines informed consent and can cause operators to expose sensitive database metadata under assumptions that processing is purely local.

Intent-Code Divergence

Medium

Confidence: 99% confidence
Finding: The skill claims credentials are not written to persistent storage, but the execution examples pass database passwords directly on the command line. Command-line arguments are commonly exposed through process listings, shell history, audit logs, and crash telemetry, so credentials may be disclosed to other local users or retained on disk indirectly.

Intent-Code Divergence

Low

Confidence: 88% confidence
Finding: The safety statement describes a narrowly local data flow between the script and the database server, but the skill also supports SSH-based collection from target hosts. Even if not inherently malicious, this omission is security-relevant because it expands the set of remote systems contacted and the categories of credentials handled.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The module-level security statement says AI diagnostics only support local Ollama and that data is not sent to third parties, but the implementation later supports an OpenAI-compatible remote backend. This creates a trust-boundary mismatch: operators may enable or invoke AI features assuming data remains local, while inspection data, issue summaries, and potentially sensitive database/system metadata can be transmitted externally.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The run_full_analysis docstring and nearby security comments claim AI diagnosis is local-only, but AIAdvisor can route prompts to remote OpenAI-compatible APIs when enabled. Because the prompt contains health metrics, findings, and labels derived from database inspection context, this can exfiltrate operationally sensitive information under misleading assurances.

Intent-Code Divergence

Low

Confidence: 97% confidence
Finding: This is a real information disclosure issue because the code comment says disk device names are desensitized, but the assignment keeps the original value when a device key exists. In a database inspection/reporting tool, device names can reveal host layout, storage topology, mount conventions, cloud/provider patterns, or other infrastructure details that the report consumer may not be authorized to see.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The code starts a Web UI bound to 0.0.0.0, making it reachable from other hosts on the network by default. In a database inspection tool that may process credentials and sensitive operational data, exposing a network service broadens attack surface and can enable unauthorized access if the Web UI lacks strong authentication or is deployed on an untrusted network.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The code can send the collected inspection context, which includes database metadata, user/account information, host details, performance data, and potentially sensitive SQL-related content, to an external AI service configured via ai_config.json. This creates a real data-exfiltration/privacy risk because the transfer occurs without clear in-band consent, scoping, sanitization, or minimization safeguards.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill opens SSH sessions to remote hosts and executes shell commands (`top`, `nproc`, `lscpu`, `free`, `df`, `hostname`, `uname`, `who`) to collect system information. While aligned with health inspection, this materially expands the trust boundary from database access to remote command execution on hosts, increasing risk if the tool is run against sensitive systems or with over-privileged credentials.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The code loads AI backend configuration and can send collected inspection context, including database metadata, host details, and discovered issues, to an external AI service. This creates a clear data exfiltration path for potentially sensitive operational information, especially because the transfer target is configurable and there is no visible sanitization, minimization, or explicit consent gate at the point of transmission.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The slow-query analysis path also constructs an AI advisor and passes analysis results from the live database connection into optional AI-assisted diagnosis. Slow-query data often contains raw SQL text, schema names, and embedded literals, making this path especially sensitive and likely to leak proprietary or secret-bearing content to third-party services.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill performs broad host-level inspection beyond database-only health checks by collecting OS release, kernel, CPU, memory, disk usage, hosts, sysctl, limits, crontab, network, and selected /etc/passwd entries. In a database inspection context this materially expands the data access surface and can expose sensitive infrastructure information if run on production systems or over SSH without clear scoping and disclosure.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The code loads external AI backend configuration and sends summarized database and host metrics plus risk items to an external analysis service. This creates outbound data flow not inherent to local database inspection and can leak environment metadata or findings to third-party endpoints if users are unaware or configuration is unsafe.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The skill is presented as a database health inspection tool, but it also establishes SSH sessions to remote hosts and executes shell commands on them to collect system information. This expands the trust boundary significantly: using supplied credentials, the tool can run commands on arbitrary hosts, which is dangerous in agent contexts where users may not expect remote command execution from a reporting skill.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The code loads local AI backend configuration and may transmit collected inspection context to an external AI service for diagnosis. In a database inspection tool, this can expose sensitive operational metadata, query text, user/account details, and environment information to third-party services without strong in-band disclosure or redaction.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The slow-query analysis path independently constructs an AI advisor from local config, creating another outbound data flow that can send query analysis data to a remote service. Because slow-query content often contains sensitive SQL and schema details, this undeclared exfiltration path materially raises confidentiality risk.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The skill collects host-level CPU, memory, disk, hostname, and platform information either locally or from a remote host over SSH, which exceeds the core database-inspection scope described in the metadata. This broadens data access and can expose sensitive infrastructure details unnecessarily, especially when users may expect only database telemetry to be gathered.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The AI diagnosis path loads external AI service configuration and sends the collected inspection dataset and detected issues to an AI advisor. That can transfer sensitive database and host telemetry, potentially including query text, configuration, and environment details, to a third-party endpoint without strong in-flow disclosure or data minimization.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The skill is described as a database health-check tool, but it can also SSH into remote hosts and execute shell commands, expanding its operational scope into host-level access. That mismatch increases the chance of operators granting broader credentials than expected, leading to unnecessary exposure of remote systems and sensitive host data.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The script can send the full inspection context to an external AI backend, which may include database metadata, system details, users, process lists, and configuration information. This creates a significant data exfiltration/privacy risk, especially because the skill description does not clearly disclose outbound transmission to third-party services.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger phrases are very broad, such as generic requests to 'inspect a database' or 'generate a database inspection report.' In an assistant environment, this increases the chance of the skill being auto-invoked for ordinary database-related conversations, causing unintended handling of sensitive connection details or launching intrusive inspection workflows the user did not explicitly mean to authorize.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README advertises that each finding includes repair SQL that can be copied and executed directly, but it does not prominently warn that generated remediation SQL may be unsafe for production, version-specific, or harmful if applied without review. In a database administration context, operators may trust the report and run commands that alter configuration, permissions, indexing, replication, or storage state, potentially causing outages, data loss, or weakened security.

Vague Triggers

Medium

Confidence: 78% confidence
Finding: The trigger conditions include broad natural-language phrases that could match ordinary conversation and unintentionally activate a skill that requests credentials and runs shell/network operations. In this context, accidental invocation is more dangerous than usual because the skill handles sensitive database access and writes local artifacts.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: At the point of use, run_full_analysis automatically calls advisor.diagnose() when the advisor is enabled, without a user-facing warning that data may be sent to a remote endpoint. In a database health-check tool, the prompt includes findings, host labels, metrics, and possibly slow-query text, making silent outbound transmission risky in production or regulated environments.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.exposed_secret_literal

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/run_inspection.py:120

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/main_dm.py:973

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/main_ivorysql.py:288

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/main_mysql.py:300

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/main_pg.py:283

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/main_sqlserver.py:1115

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/main_tidb.py:317