Security audit

Autotable Usage

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only AutoTable usage skill with database-change guidance that is mostly disclosed and purpose-aligned.

Install only if you want Chinese AutoTable framework guidance. Before applying generated configuration to real databases, keep production on validate or none unless reviewed, disable auto-drop-table and auto-drop-column outside disposable environments, back up data, and provide database admin credentials through a secret manager or environment variables rather than checked-in config.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (13)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The activation text is broad and open-ended: it triggers whenever a user asks about AutoTable usage, annotations, configuration, extensions, or best practices, without clear narrowing conditions. Over-broad routing can cause the skill to activate in contexts where the user did not explicitly request schema-changing guidance, increasing the chance of unsafe or irrelevant advice around database-altering operations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The main skill description advertises a complete usage guide for an automatic table-management framework but does not upfront warn that some documented modes can delete and recreate tables or drop schema objects. Because the skill covers operational guidance, the absence of a prominent warning may lead users to apply destructive settings such as create mode or auto-drop options in inappropriate environments, causing data loss.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The guide explicitly recommends auto-drop-column: true and auto-drop-index: true in development, but the warning about destructive behavior appears later in the document rather than at the configuration point itself. This can normalize unsafe defaults and lead users to copy the snippet into the wrong profile or shared environment, causing unintended schema destruction or loss of historical data.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: SQP-3 applies to all file types and covers language or locale policy violations. This file forces a single language presentation throughout, with no indication that users may choose another language or that the Chinese-only format is intentionally limited to a specific audience or region.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file documents admin-user and admin-password settings, which involve sensitive credentials, but it does not warn users not to hardcode real secrets, commit them to source control, or prefer secure secret management. Under the markdown-file criteria, omissions around privacy- or system-integrity-affecting behavior should be flagged.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The example shows admin-user and admin-password for PostgreSQL administrative access, which can affect system integrity if handled insecurely. The surrounding documentation does not disclose the sensitivity of these values or warn against storing real credentials directly in configuration files.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documentation explicitly describes destructive schema actions such as 'DROP + CREATE', column drops, and deleting unregistered tables, but it does not prominently warn that these operations can cause irreversible data loss. In an agent skill intended to guide users on AutoTable usage, omission of safety warnings increases the chance that users enable dangerous modes or hooks in production without understanding the consequences.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The guide explicitly promotes automatic schema creation and incremental updates on application startup without a prominent warning about the risk of modifying production databases. In a quick-start document, users may copy these settings directly into real environments, leading to unintended ALTER TABLE operations, startup-time schema drift, outages, or data loss if changes are incompatible.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file uses Chinese throughout, including the title and all explanatory text, which effectively forces a specific language for users reading the skill documentation. Under the policy, language constraints should either offer user choice or be clearly documented as a justified locale-specific limitation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file contains all user-facing documentation in Chinese and does not indicate that other languages are available or that the locale is intentionally constrained. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: This markdown file applies to SQP-2, and it includes a complete YAML example that turns on record-sql.enable and writes SQL audit records to ./flyway-migrations. While the document labels some destructive schema options as dangerous elsewhere, it does not provide a comparable user-facing warning here that SQL statements may be persisted to disk and could expose schema or operational details.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file presents all user-facing instructions and examples exclusively in Chinese. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file presents all instructions and examples exclusively in Chinese, and there is no indication that the skill is region-specific or that users can opt into another language. Under the language/locale policy rule, forcing a specific language without opt-in can be a policy violation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.