ClawHub
Back to skill

Security audit

Database Manager

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed database-operations playbook that stores optional local context and emphasizes user confirmation for risky database actions.

Install only if you want a persistent local database operations notebook. Keep secrets, passwords, connection strings, and private keys out of ~/database-manager/, and review any proposed production database action before approving it.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Anti-Refusal Statement

High
Category
Anti-Refusal
Content
- define one guardrail per failure mode
- schedule follow-up validation date

Incident closure without guardrails invites repeat failures.
Confidence
80% confidence
Finding
Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Context Leakage

High
Category
Data Exfiltration
Content
## Baseline Context to Capture

Capture context that improves future decisions:
- Main database engines and versions in use
- Critical systems and data domains
- Recovery objectives (RTO and RPO targets)
Confidence
93% confidence
Finding
The skill instructs the agent to capture and store operationally sensitive environment details such as database engines, critical systems, data domains, and recovery targets. Persisting this information in local memory increases the risk of unnecessary retention and later disclosure of infrastructure and business-critical metadata, especially if the stored context is broader than needed for the active task.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
```bash
mkdir -p ~/database-manager/archive
touch ~/database-manager/{memory.md,inventory.md,standards.md,migrations.md,backups.md,incidents.md}
chmod 700 ~/database-manager
chmod 600 ~/database-manager/{memory.md,inventory.md,standards.md,migrations.md,backups.md,incidents.md}
```
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
mkdir -p ~/database-manager/archive
touch ~/database-manager/{memory.md,inventory.md,standards.md,migrations.md,backups.md,incidents.md}
chmod 700 ~/database-manager
chmod 600 ~/database-manager/{memory.md,inventory.md,standards.md,migrations.md,backups.md,incidents.md}
```

3. If `memory.md` is empty, initialize it from `memory-template.md`.
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The activation boundaries say to 'Always activate for schema, migration, or query performance requests' while also saying to activate only when the user explicitly asks for database help. These conditions are ambiguous and broad enough to overlap with ordinary technical discussion, and they do not provide clear exclusions or negative examples to resolve when the skill should stay inactive.

Static analysis

No suspicious patterns detected.