T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate_database_doc.py:187- Finding
Documented TLS Settings Are Not Applied to PostgreSQL Connections
- Content
View full analysis
- Remediation
View remediation
Security audit
database-doc-generator
Security checks for vulnerabilities and agentic risk
Overview
The skill mainly matches its database-documentation purpose, but it ships real-looking historical credentials and broad cleanup tooling that can rewrite or delete project files.
Do not install this package as-is in a sensitive environment. Ask the maintainer to fully redact historical credential material, remove or isolate the credential-cleanup utility, stop accepting passwords on the command line, correctly enforce TLS settings, secure output-file permissions, sanitize spreadsheet cells, and update vulnerable development tooling. If you still test it, use a disposable environment, a read-only database account, protected environment variables or a secrets manager, and a private output directory.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (6)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate_database_doc.py:301- Finding
Database Passwords Can Be Supplied Through Process Arguments
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate_database_doc.py:242- Finding
Generated Database Documentation Is Not Protected with Restrictive File Permissions
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate_database_doc.py:25- Finding
Untrusted Database Metadata Can Be Exported as Active Spreadsheet Formulas
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
EMERGENCY_RESPONSE.md:76- Finding
Previously Exposed Database Credential Material Remains in Distributed Documentation
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/clean_credentials.py:73- Finding
Credential Cleanup Utility Creates Plaintext Backups Containing the Secrets It Removes
- Content
View full analysis
0: content = new_content modified = True if modified and content != original_content: # Backup original backup_path = file_path.with_suffix(file_path.suffix + '.bak') if not backup_path.exists(): with open(backup_path, 'w', encoding='utf-8') as f: f.write(original_content) # Write cleaned content with open(file_path, 'w', encoding='utf-8') as f: f.write(content) ``` Backup deletion is optional and occurs only after interactive confirmation: ```python if cleaner.print_report(): print("\n[OK] Cleanup completed. Please review changes.") # Ask for confirmation to delete backups response = input("\nDelete backup files (*.bak)? (yes/no): ") if response.lower() == 'yes': for bak_file in root_dir.rglob('*.bak'): bak_file.unlink() print("Backup files deleted.") ``` ### Technical Analysis When a matching credential is found, the utility writes the complete original file to a sibling `.bak` file before replacing the source. The backup therefore contains the sensitive value the operation is intended to remove. Backup permissions depend on the process umask, and backups remain indefinitely if execution is interrupted, the user answers anything other than `yes`, or the utility runs non ...[truncated 1251 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (49)
Known Vulnerable Dependency: black==24.1.1 — 4 advisory(ies): CVE-2024-21503 (Black vulnerable to Regular Expression Denial of Service (ReDoS)); CVE-2024-21503 (Versions of the package black before 24.3.0 are vulnerable to Regular Expression); CVE-2026-31900 (Black is the uncompromising Python code formatter. Black provides a GitHub actio) +1 more
Critical
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
The file pins black to 24.1.1, which is flagged with known vulnerabilities including a Regular Expression Denial of Service issue. In this skill context, Black is a development tool, so exploitation is less severe than a production dependency, but it can still be abused in CI or developer workflows by feeding crafted source files that cause excessive processing or denial of service.
- Content
Known Vulnerable Dependency: virtualenv==20.25.0 — 4 advisory(ies): CVE-2026-22702 (virtualenv Has TOCTOU Vulnerabilities in Directory Creation); CVE-2024-53899 (virtualenv allows command injection through activation scripts for a virtual env); CVE-2024-53899 (virtualenv before 20.26.6 allows command injection through the activation script) +1 more
Critical
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The file pins virtualenv to 20.25.0, which is reported as vulnerable to command injection in activation scripts and TOCTOU issues in directory creation. Even as a development dependency, this is dangerous because virtualenv is commonly executed on developer systems and CI runners; if an attacker can influence environment names, paths, or script generation/consumption, it can lead to code execution in trusted build environments.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - API keys/tokens - SSH private keys - Encryption keys - Personal access tokens - Certificate private keys - Authentication cookies/sessions
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 70% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
--prune-empty --tag-name-filter cat -- --all
Force push (warns collaborators)
git push origin --force --all
text 3. **Audit Access Logs**
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
2. Application Recovery
bash # Update all configuration files find . -name "*.py" -o -name "*.json" -o -name "*.yaml" -o -name "*.env" | xargs grep -l "192.168.3.87\|monitor_inform_test\|Edan@edan" # Update environment variables sed -i 's/192.168.3.87/NEW_HOST/g' .env
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
find . -name ".py" -o -name ".json" -o -name ".yaml" -o -name ".env" | xargs grep -l "192.168.3.87|monitor_inform_test|Edan@edan"
Update environment variables
sed -i 's/192.168.3.87/NEW_HOST/g' .env sed -i 's/monitor_inform_test/NEW_DATABASE/g' .env
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
find . -name ".py" -o -name ".json" -o -name ".yaml" -o -name ".env" | xargs grep -l "192.168.3.87|monitor_inform_test|Edan@edan"
Update environment variables
sed -i 's/192.168.3.87/NEW_HOST/g' .env sed -i 's/monitor_inform_test/NEW_DATABASE/g' .env
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
find . -name ".py" -o -name ".json" -o -name ".yaml" -o -name ".env" | xargs grep -l "192.168.3.87|monitor_inform_test|Edan@edan"
Update environment variables
sed -i 's/192.168.3.87/NEW_HOST/g' .env sed -i 's/monitor_inform_test/NEW_DATABASE/g' .env
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
find . -name ".py" -o -name ".json" -o -name ".yaml" -o -name ".env" | xargs grep -l "192.168.3.87|monitor_inform_test|Edan@edan"
Update environment variables
sed -i 's/192.168.3.87/NEW_HOST/g' .env sed -i 's/monitor_inform_test/NEW_DATABASE/g' .env
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
find . -name ".py" -o -name ".json" -o -name ".yaml" -o -name ".env" | xargs grep -l "192.168.3.87|monitor_inform_test|Edan@edan"
Update environment variables
sed -i 's/192.168.3.87/NEW_HOST/g' .env sed -i 's/monitor_inform_test/NEW_DATABASE/g' .env
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
find . -name ".py" -o -name ".json" -o -name ".yaml" -o -name ".env" | xargs grep -l "192.168.3.87|monitor_inform_test|Edan@edan"
Update environment variables
sed -i 's/192.168.3.87/NEW_HOST/g' .env sed -i 's/monitor_inform_test/NEW_DATABASE/g' .env
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 88% confidence
- Finding
The command
export $(grep -v '^#' .env | xargs)unsafely loads secrets from a plaintext file using shell parsing that can mis-handle spaces, quotes, or shell-special characters. In addition to reliability issues, this pattern can leak secrets through shell history, process inspection, or unintended shell evaluation in some environments, making credential handling weaker than necessary.- Content
EOF
Load environment variables
export $(grep -v '^#' .env | xargs)
text ### 3. Configure Git Ignore
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill appears to inspect local source files, environment variables, JSON configs, file permissions, and installed packages while presenting itself as a database documentation generator. Accessing these sensitive local resources without clear necessity creates a path for credential exposure and over-collection of host information.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill appears to inspect local source files, environment variables, JSON configs, file permissions, and installed packages while presenting itself as a database documentation generator. Accessing these sensitive local resources without clear necessity creates a path for credential exposure and over-collection of host information.
- Content
Known Vulnerable Dependency: pytest==8.0.0 — 2 advisory(ies): CVE-2025-71176 (pytest has vulnerable tmpdir handling); CVE-2025-71176 (pytest has vulnerable tmpdir handling)
High
- Category
- Supply Chain
- Confidence
- 89% confidence
- Finding
The development dependency pins pytest to 8.0.0, which is reported as affected by a tmpdir-handling vulnerability. Although this is a dev-only package rather than application runtime code, compromised test execution or unsafe temporary-directory behavior can still affect CI environments, local developer machines, or test artifacts if an attacker can influence filesystem state.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This script is unrelated to the stated purpose of a PostgreSQL database documentation generator and performs repository-wide content rewriting instead. Even if framed as hygiene tooling, bundling a credential-scrubbing utility into an unrelated skill increases the chance of unauthorized file modification, concealment of embedded secrets, or accidental destruction of evidence during normal skill use.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script recursively scans the repository, rewrites matching files, creates backup copies, and can bulk-delete all .bak files after a prompt. In the context of a database documentation skill, this broad file-modification and deletion capability is unjustified and dangerous because it can alter unrelated project files, erase recovery artifacts, and interfere with audits or incident response if triggered by a user or integrated workflow.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This section includes operational recovery commands such as backups and in-place configuration edits that could alter production systems, but it does not clearly warn readers about prerequisites, environment validation, or the risk of running them blindly. In a skill artifact, users may copy-paste these commands during an incident, increasing the chance of accidental damage, data leakage, or unsafe changes under pressure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The markdown includes
rm -rf venv-database-docs,pip uninstall -y, andpip cache purge, which can remove environments, packages, and cached artifacts. Although the section is labeled 'Safe Removal,' it does not explicitly warn users that these actions are destructive and should be run only against the intended environment.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The README uses broad natural-language invocation examples like generating documentation for a table without clearly constraining when the skill should activate or what exact parameters are required. In an agent environment, this can cause over-broad triggering, accidental handling of sensitive database tasks, or confusion between ordinary conversation and a request to access database-connected functionality.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The additional examples include ambiguous free-form requests and inline credential-style text, which may encourage unsafe prompting patterns and overly permissive skill invocation. In a tool-using agent, this increases the chance of unintended activation, mishandling of secrets supplied in conversational text, or execution against the wrong database scope.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Set restrictive permissions:
bash chmod 600 /path/to/secure-config.json3. Command Line Arguments (NOT RECOMMENDED)
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Set restrictive permissions:
bash chmod 600 /path/to/secure-config.json3. Command Line Arguments (NOT RECOMMENDED)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 85% confidence
- Finding
The skill declares no explicit tool scope despite instructing use of environment variables and file read/write operations. In an agent setting, missing capability declarations weakens least-privilege controls and can cause the runtime to grant broader access than users expect.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The output description specifies column headers in Chinese characters only: 代码, 数据类型, 长度, 强制, 注释. This imposes a specific language on generated output without user opt-in or a documented regional justification, which matches the language/locale policy violation criteria.
- Content
Static analysis
No suspicious patterns detected.