Security audit

Simpleerp DB

Security checks for vulnerabilities and agentic risk

Overview

The skill has a legitimate database-reporting purpose, but it needs review because it handles live Oracle credentials and local files with weak controls.

Review before installing. Use only a dedicated least-privilege read-only Oracle account, avoid passing passwords in chat or command-line flags, avoid sync-env unless file permissions and cleanup are controlled, keep output paths inside the skill output directory, and do not enable persistent memory for ERP data unless you have a retention policy.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/run-sql.mjs:132
Finding: Incomplete read-only SQL enforcement permits database-side effects
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/run-sql.mjs:167
Finding: User-controlled output paths permit arbitrary file overwrite
Content: View full analysis
Remediation: View remediation
/output` directory. 2. Resolve both the output directory and requested path with `path.resolve()`, then verify that the requested path is a descendant of the approved directory. 3. Reject absolute paths, `..` traversal, symlinks escaping the approved directory, device paths, and empty output names. 4. Consider accepting only generated file names rather than arbitrary paths. 5. Use exclusive creation where overwriting is unnecessary, or write to a securely created temporary file and atomically rename it. 6. Refuse to overwrite existing non-artifact files. 7. Apply equivalent containment controls to every configurable output path in both project copies. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: PROMPTS.md:35
Finding: Database credentials are exposed through command-line arguments and insufficiently protected files
Content: View full analysis
" ``` It also recommends persisting the password through a command-line argument: ```bash node scripts/sync-db-env.mjs \ --db-user="${DB_USER}" \ --db-password="${DB_PASSWORD}" \ --db-connect-string="${DB_CONNECT_STRING}" npm run sql:save -- "" ``` The persistence implementation writes plaintext values without explicitly restricting permissions: ```js for (const key of Object.values(FLAG_MAP)) { if (updates[key] !== undefined && !seen.has(key)) { out.push(`${key}=${updates[key]}`); } } while (out.length > 0 && out[out.length - 1] === '') out.pop(); fs.writeFileSync(ENV_PATH, `${out.join('\n')}\n`, 'utf8'); ``` ### Technical Analysis Command-line arguments may be visible in process listings, shell history, job metadata, diagnostics, audit systems, and orchestration logs. Advising users to pass `DB_PASSWORD` in `argv` expands exposure beyond the database driver. The optional persistence workflow writes the credentials into `.env` as plaintext. `fs.writeFileSync()` uses normal inherited creation permissions subject to the process umask and does not enforce owner-only access. If the file already exists, its potentially permissive mode is retained. The code avoids printing secret values directly, but that safeguard does not address process-argument or filesystem disclosure. ### Attack Path 1. A user follows `PROMPTS.m ...[truncated 931 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/setup.mjs:42
Finding: Mandatory setup installs mutable dependencies without a lockfile
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Warning

Location: AGENTS.md:11
Finding: Skill instructions encourage uncontrolled persistence of user and ERP activity data
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (71)

Credential Access

High

Category: Privilege Escalation
Confidence: 96% confidence
Finding: This instruction directs the agent to access and potentially create a .env-backed credential store using supplied DB secrets, which is a genuine credential-handling risk. In the context of an agent workspace, secrets written to disk may be exposed to logs, other processes, future tasks, or repository operations, making the risk more serious than ordinary local command usage.
Content: Scanner excerpt · PROMPTS.md (reported line 78)May include surrounding context.
md
2. Read references/table-reference.md or table-index.md as needed for correct table and column names. 3. **You** choose the read-only Oracle SQL (SELECT or WITH only) that answers ${QUESTION}. Use FETCH FIRST 50 ROWS ONLY unless a count or aggregate alone is enough. 4. Run the query (cross-platform): - If .env is not set: node scripts/sync-db-env.mjs --db-user="${DB_USER}" --db-password="${DB_PASSWORD}" --db-connect-string="${DB_CONNECT_STRING}" - Then: npm run sql:save -- "<your SELECT here>" - Or one shot: node scripts/run-sql.mjs --db-user=... --db-password=... --db-connect-string=... -o output/last-query.json "<your SELECT>" 5. Read output/last-query.json and reply with:

Credential Access

High

Category: Privilege Escalation
Confidence: 94% confidence
Finding: The code defines a workspace .env path and later writes DB_USER, DB_PASSWORD, and DB_CONNECT_STRING into it, creating a persistent plaintext secret store inside the project directory. In this skill context, Oracle credentials are powerful and likely grant access to live enterprise data, so local persistence increases the blast radius if the workspace is shared, indexed, backed up, or committed.
Content: Scanner excerpt · scripts/sync-db-env.mjs (reported line 15)May include surrounding context.
js
import path from 'path'; import { SKILL_ROOT } from './lib/paths.mjs'; const ENV_PATH = path.join(SKILL_ROOT, '.env'); const FLAG_MAP = { '--db-user': 'DB_USER',

Credential Access

High

Category: Privilege Escalation
Confidence: 96% confidence
Finding: The prompt directs the agent to handle live Oracle credentials, including writing them into a workspace .env file via sync-db-env.mjs or passing them on the command line. Even though it says not to print secrets, storing or passing credentials this way increases exposure through shell history, process listings, workspace files, logs, and accidental reuse by other tools in the same environment.
Content: Scanner excerpt · simpleerp-db-clean/PROMPTS.md (reported line 78)May include surrounding context.
md
2. Read references/table-reference.md or table-index.md as needed for correct table and column names. 3. **You** choose the read-only Oracle SQL (SELECT or WITH only) that answers ${QUESTION}. Use FETCH FIRST 50 ROWS ONLY unless a count or aggregate alone is enough. 4. Run the query (cross-platform): - If .env is not set: node scripts/sync-db-env.mjs --db-user="${DB_USER}" --db-password="${DB_PASSWORD}" --db-connect-string="${DB_CONNECT_STRING}" - Then: npm run sql:save -- "<your SELECT here>" - Or one shot: node scripts/run-sql.mjs --db-user=... --db-password=... --db-connect-string=... -o output/last-query.json "<your SELECT>" 5. Read output/last-query.json and reply with:

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 23)May include surrounding context.
bash
cd path/to/simpleerp-db-clean npm install cp .env.example .env # Edit .env npm run setup

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/bootstrap.md (reported line 39)May include surrounding context.
bash
cd path/to/simpleerp-db-clean npm install cp .env.example .env # Edit .env npm run setup

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/bootstrap.md (reported line 48)May include surrounding context.
bash
cd path/to/simpleerp-db-clean npm install cp .env.example .env # Edit .env npm run setup

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · simpleerp-db-clean/README.md (reported line 23)May include surrounding context.
bash
cd path/to/simpleerp-db-clean npm install cp .env.example .env # Edit .env npm run setup

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · simpleerp-db-clean/references/bootstrap.md (reported line 39)May include surrounding context.
bash
cd path/to/simpleerp-db-clean npm install cp .env.example .env # Edit .env npm run setup

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · simpleerp-db-clean/references/bootstrap.md (reported line 48)May include surrounding context.
bash
cd path/to/simpleerp-db-clean npm install cp .env.example .env # Edit .env npm run setup

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/check-prereqs.mjs (reported line 18)May include surrounding context.
js
const REQUIRED_ENV = ['DB_USER', 'DB_PASSWORD', 'DB_CONNECT_STRING']; function loadDotenv() { const envPath = path.join(SKILL_ROOT, '.env'); if (!fs.existsSync(envPath)) return; for (const line of fs.readFileSync(envPath, 'utf8').split(/\r?\n/)) { const m = line.match(/^([A-Z_]+)=(.*)$/);

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/check-prereqs.mjs (reported line 71)May include surrounding context.
js
const REQUIRED_ENV = ['DB_USER', 'DB_PASSWORD', 'DB_CONNECT_STRING']; function loadDotenv() { const envPath = path.join(SKILL_ROOT, '.env'); if (!fs.existsSync(envPath)) return; for (const line of fs.readFileSync(envPath, 'utf8').split(/\r?\n/)) { const m = line.match(/^([A-Z_]+)=(.*)$/);

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/export-tables-sql.mjs (reported line 30)May include surrounding context.
js
const REQUIRED_ENV = ['DB_USER', 'DB_PASSWORD', 'DB_CONNECT_STRING']; function loadDotenv() { const envPath = path.join(SKILL_ROOT, '.env'); if (!fs.existsSync(envPath)) return; for (const line of fs.readFileSync(envPath, 'utf8').split(/\r?\n/)) { const m = line.match(/^([A-Z_]+)=(.*)$/);

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/run-sql.mjs (reported line 117)May include surrounding context.
js
const REQUIRED_ENV = ['DB_USER', 'DB_PASSWORD', 'DB_CONNECT_STRING']; function loadDotenv() { const envPath = path.join(SKILL_ROOT, '.env'); if (!fs.existsSync(envPath)) return; for (const line of fs.readFileSync(envPath, 'utf8').split(/\r?\n/)) { const m = line.match(/^([A-Z_]+)=(.*)$/);

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/setup.mjs (reported line 19)May include surrounding context.
js
const REQUIRED_ENV = ['DB_USER', 'DB_PASSWORD', 'DB_CONNECT_STRING']; function loadDotenv() { const envPath = path.join(SKILL_ROOT, '.env'); if (!fs.existsSync(envPath)) return; for (const line of fs.readFileSync(envPath, 'utf8').split(/\r?\n/)) { const m = line.match(/^([A-Z_]+)=(.*)$/);

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/setup.mjs (reported line 57)May include surrounding context.
js
const REQUIRED_ENV = ['DB_USER', 'DB_PASSWORD', 'DB_CONNECT_STRING']; function loadDotenv() { const envPath = path.join(SKILL_ROOT, '.env'); if (!fs.existsSync(envPath)) return; for (const line of fs.readFileSync(envPath, 'utf8').split(/\r?\n/)) { const m = line.match(/^([A-Z_]+)=(.*)$/);

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · simpleerp-db-clean/scripts/check-prereqs.mjs (reported line 18)May include surrounding context.
js
const REQUIRED_ENV = ['DB_USER', 'DB_PASSWORD', 'DB_CONNECT_STRING']; function loadDotenv() { const envPath = path.join(SKILL_ROOT, '.env'); if (!fs.existsSync(envPath)) return; for (const line of fs.readFileSync(envPath, 'utf8').split(/\r?\n/)) { const m = line.match(/^([A-Z_]+)=(.*)$/);

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · simpleerp-db-clean/scripts/check-prereqs.mjs (reported line 71)May include surrounding context.
js
const REQUIRED_ENV = ['DB_USER', 'DB_PASSWORD', 'DB_CONNECT_STRING']; function loadDotenv() { const envPath = path.join(SKILL_ROOT, '.env'); if (!fs.existsSync(envPath)) return; for (const line of fs.readFileSync(envPath, 'utf8').split(/\r?\n/)) { const m = line.match(/^([A-Z_]+)=(.*)$/);

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · simpleerp-db-clean/scripts/export-tables-sql.mjs (reported line 30)May include surrounding context.
js
const REQUIRED_ENV = ['DB_USER', 'DB_PASSWORD', 'DB_CONNECT_STRING']; function loadDotenv() { const envPath = path.join(SKILL_ROOT, '.env'); if (!fs.existsSync(envPath)) return; for (const line of fs.readFileSync(envPath, 'utf8').split(/\r?\n/)) { const m = line.match(/^([A-Z_]+)=(.*)$/);

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · simpleerp-db-clean/scripts/run-sql.mjs (reported line 117)May include surrounding context.
js
const REQUIRED_ENV = ['DB_USER', 'DB_PASSWORD', 'DB_CONNECT_STRING']; function loadDotenv() { const envPath = path.join(SKILL_ROOT, '.env'); if (!fs.existsSync(envPath)) return; for (const line of fs.readFileSync(envPath, 'utf8').split(/\r?\n/)) { const m = line.match(/^([A-Z_]+)=(.*)$/);

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · simpleerp-db-clean/scripts/setup.mjs (reported line 19)May include surrounding context.
js
const REQUIRED_ENV = ['DB_USER', 'DB_PASSWORD', 'DB_CONNECT_STRING']; function loadDotenv() { const envPath = path.join(SKILL_ROOT, '.env'); if (!fs.existsSync(envPath)) return; for (const line of fs.readFileSync(envPath, 'utf8').split(/\r?\n/)) { const m = line.match(/^([A-Z_]+)=(.*)$/);

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · simpleerp-db-clean/scripts/setup.mjs (reported line 57)May include surrounding context.
js
const REQUIRED_ENV = ['DB_USER', 'DB_PASSWORD', 'DB_CONNECT_STRING']; function loadDotenv() { const envPath = path.join(SKILL_ROOT, '.env'); if (!fs.existsSync(envPath)) return; for (const line of fs.readFileSync(envPath, 'utf8').split(/\r?\n/)) { const m = line.match(/^([A-Z_]+)=(.*)$/);

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · PROMPTS.md (reported line 85)May include surrounding context.
md
/** * Write or update DB_* lines in workspace .env from CLI flags or process.env. * Cross-platform alternative to shell-specific $env: / export syntax. * * Usage:

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 13)May include surrounding context.
md
/** * Write or update DB_* lines in workspace .env from CLI flags or process.env. * Cross-platform alternative to shell-specific $env: / export syntax. * * Usage:

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 24)May include surrounding context.
md
/** * Write or update DB_* lines in workspace .env from CLI flags or process.env. * Cross-platform alternative to shell-specific $env: / export syntax. * * Usage:

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.
md
/** * Write or update DB_* lines in workspace .env from CLI flags or process.env. * Cross-platform alternative to shell-specific $env: / export syntax. * * Usage:

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/setup.mjs:30

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: simpleerp-db-clean/scripts/setup.mjs:30