huawei-cloud-ascend-profiler-db-explorer

• Outcome: Review
• Latest audit: Jul 21, 2026 · 9:28 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent Ascend profiler database helper, but it needs Review because it can run raw SQL against local database files without clear read-only limits and its activation scope is too broad.

Install only if you intend to let the agent inspect a specific Ascend/msprof profiler SQLite database. Review generated SQL before execution, keep queries read-only, avoid using it with unrelated or sensitive databases, and prefer explicit prompts that include the intended profiler DB path and analysis goal.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill declares tool access to python3 and sqlite3 and instructs reading local documentation and database files, but there is no explicit permission model or scope restriction for file reads. In an agent setting, undocumented file-read capability can expose local files, database contents, or nearby documentation beyond the user’s intended query, especially when natural-language input is turned into execution steps.

Intent-Code Divergence

Medium

• Confidence: 82% confidence
• Finding: The documentation gives conflicting instructions about schema discovery: it says schema should come from get_schema.py and PRAGMA should be only supplemental, while also directing direct sqlite metadata commands. Contradictory operational guidance weakens safety controls because an agent may fall back to raw sqlite inspection or broader commands, bypassing the intended constrained schema path.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The skill promises 'safe executable SQL' but the instructions permit direct SQLite commands and execution tooling without a concrete read-only query policy, parameter validation, or SQL allowlist. A natural-language-to-SQL agent with unrestricted execution can be steered into arbitrary queries, data exfiltration, attachment of other databases, or destructive statements if the runtime does not enforce read-only mode.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The trigger list includes broad terms like 'sql', 'table', and 'schema', which can cause this skill to activate for unrelated requests. Over-broad activation is risky because it routes generic database questions into a skill that can generate and execute SQL, increasing the chance of unintended data access or misuse in contexts outside Ascend profiling.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: Ambiguous examples such as 'Operator?' or 'QueryprofilerDatabase' do not clearly anchor the domain and can make the router invoke the skill on underspecified prompts. In an execution-capable SQL skill, weak activation criteria increase the risk of accidental query generation or interaction with local databases when the user intent is unclear.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.