Migration Validator

• Outcome: Pass
• Latest audit: Jun 2, 2026, 4:19 PM
• Version:
  1.0.0

Overview

This migration-validation skill is purpose-aligned and locally scoped, but users should run it only against intended migration folders and trusted SQL files.

Install only if you are comfortable with the skill reading the configured migrations directory and SQLite migration table. Configure the paths deliberately, avoid pointing it at production data unnecessarily, and run it in CI or another controlled environment because it executes local migration SQL in SQLite memory for validation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence
• Finding: The skill documentation declares no permissions while the skill behavior implies filesystem access to scan migration directories and read SQL files. Undeclared file-read capability weakens transparency and policy enforcement, which can let a caller invoke broader data access than reviewers or operators expect.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The documented purpose is narrow syntax validation, but the described behavior is substantially broader: it accesses a real database, inspects migration state, executes SQL in an in-memory engine, and reports inventory data. This mismatch is dangerous because reviewers may approve the skill for low-risk validation while it actually performs database interaction and richer data processing, increasing the chance of unauthorized access, side effects, or information disclosure.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The validator reads and executes every .sql file in the migrations directory using executescript(), including already-applied migrations, instead of limiting itself to pending migrations and non-destructive parsing. Even though execution happens in an in-memory SQLite database, this still runs attacker-controlled SQL logic during validation, which can trigger resource exhaustion, validator crashes, or unintended side effects through SQLite features and makes the tool more dangerous than a syntax checker should be.

VirusTotal

49/49 vendors flagged this skill as clean.