ClawHub
Back to skill

Security audit

SQL Toolkit

Security checks across malware telemetry and agentic risk

Overview

This SQL helper skill is purpose-aligned documentation for database command-line workflows, with no evidence of hidden behavior or malicious activity, but users should be careful with restore examples that can overwrite data.

Install only if you want Codex to help with SQL database work. Treat migration, import, and restore examples as potentially destructive: verify the target host and database, use least-privilege credentials, avoid placing real passwords in shared shell history or logs, prefer restoring into a new database first, and make a fresh backup before running commands that clean, overwrite, or import data.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill includes restore and overwrite-capable backup commands such as `pg_restore --clean --if-exists`, shell redirection into database clients, and file-copy style SQLite restore examples without explicit warnings that they can replace existing data or drop objects. In an agent skill context, these examples may be executed or adapted by users with insufficient caution, increasing the chance of accidental data loss in production or against the wrong target database.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.