ClawHub
Back to skill

Security audit

sql-query-generator

Security checks for vulnerabilities and agentic risk

Overview

This SQL generator is purpose-aligned overall, but it sends prompts, schema text, and a user key to a default plain-HTTP backend with confusing API-key and endpoint documentation.

Review before installing. Use only non-sensitive schemas or sanitized examples, do not put a real DeepSeek API key in SQL_API_USER_KEY unless the publisher clarifies the mismatch, and avoid the default HTTP endpoint unless you can configure a trusted HTTPS service.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill declares runtime requirements for environment variables and appears to rely on outbound API access, but it does not declare corresponding permissions. This creates a transparency and policy-enforcement gap: users or hosting platforms may not realize the skill can access secrets like SQL_API_USER_KEY and transmit prompts, schema metadata, or other sensitive inputs to a remote service.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The skill is presented as a SQL query generator, but it also exposes a generic service-enumeration command that can reveal unrelated backend capabilities. This expands the operational scope beyond the advertised purpose and may help users or attackers discover additional paid or internal services exposed by the same API.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
The script contains registration, account lookup, credits, and billing-adjacent flows that are not necessary for a narrowly scoped SQL generation utility. This creates unnecessary data collection and account-management surface, increasing privacy and abuse risks while obscuring the true behavior of the skill.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
User-provided natural-language queries and optional database schema are sent to a remote third-party API, but the script provides no explicit warning or consent flow before transmitting potentially sensitive database structure or business logic. In practice, schemas often contain table names, field names, and relationships that reveal internal system design or regulated data domains.

External Transmission

Medium
Category
Data Exfiltration
Content
if method == "GET":
            resp = requests.get(url, headers=h, params=data or {}, timeout=30)
        else:
            resp = requests.post(url, headers=h, json=data or {}, timeout=60)
        if resp.status_code >= 400:
            try:
                err = resp.json()
Confidence
97% confidence
Finding
The script transmits user input and potentially sensitive schema data to an external host over the network, and the default API endpoint uses plain HTTP rather than HTTPS. This creates confidentiality and integrity risks because requests, schema contents, and the X-User-Key header may be intercepted or modified in transit.

Static analysis

No suspicious patterns detected.