SQL

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:03 PM UTC
• Version: 1.0.4

Overview

This is a coherent SQL guidance skill with disclosed local preference memory and no hidden executable behavior, but users should review destructive SQL and redact sensitive query values while debugging.

Installers should treat this as an expert SQL reference, not an automatic database operator. Keep the local memory free of secrets, review any generated UPDATE, DELETE, DROP, TRUNCATE, migration, backup, or restore command before running it, and prefer redacted SQL templates over logs containing bound parameter values.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: debug.md:9

Finding

Unredacted SQL Parameter Logging May Expose Sensitive Data

Content

View full analysis

Vulnerability Details

File Location: debug.md, line 9
Vulnerability Type: Sensitive data exposure through application logs
Risk Level: Medium

Vulnerable Instruction:

markdown

1. **Read the actual statement, not the intent.** For ORM-generated SQL, turn on query logging and copy the emitted text; for dynamic SQL, log the final string with parameters bound.

Technical Analysis

The instruction recommends logging a dynamically constructed SQL statement after its parameters have been bound. Bound values may contain passwords, authentication tokens, personal data, financial information, tenant identifiers, or other confidential application data.

This conflicts with the safer practice of logging the parameterized SQL template while redacting or omitting values. Although security.md warns against logging parameters for statements that touch identified personal-data columns, that narrower warning does not adequately constrain the unconditional instruction in debug.md. Sensitive columns may also be unclassified, and secrets can occur outside formally designated personal-data fields.

Logs commonly have broader access and longer retention than production database records. They may also be copied into centralized logging platforms, support bundles, backups, or development systems. Consequently, binding values into logged SQL can create an additional persistent copy of sensitive information.

Attack Path

1. An application handles an attacker-controlled or otherwise sensitive value as a SQL parameter.
2. An operator follows the debugging instruction and enables logging of the final SQL string with bound parameters.
3. The sensitive value is serialized into an application log, database log, or centralized observability platform.
4. A user or attacker with access to logs—but not necessarily direct access to the production database—retrieves the exposed value.
5. If the value is a credential or token, ...[truncated 656 chars]

Remediation

View remediation

Remediation Suggestions

Replace the instruction with a safe-by-default requirement to log only the parameterized statement template, duration, query identifier, and call site.

Recommended replacement:

markdown

For dynamic SQL, log the parameterized statement template without bound values. If parameter inspection is strictly necessary during a bounded debugging session, use an explicit allowlist and structured redaction. Never log passwords, tokens, connection strings, personal data, or encryption material.

Additional hardening measures:

• Redact sensitive values in both application and database log formatters.
• Use an allowlist of explicitly non-sensitive diagnostic fields rather than attempting to maintain a denylist.
• Limit verbose query logging to development or a short, authorized diagnostic window.
• Apply least-privilege access controls to logging and observability systems.
• Define short retention periods for diagnostic logs and securely delete expired records.
• Prevent production query logs from being copied into development systems or support bundles without sanitization.
• Add automated tests that verify credentials, tokens, connection strings, and designated personal-data fields are redacted.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · datetime.md (reported line 203)May include surrounding context.

md

## Error Behavior on Bad Data

- Inserting a too-long string: PostgreSQL and SQL Server error; MySQL errors in strict mode (default since 5.7) and truncated without warning before that.
- Invalid dates: MySQL historically accepted `'0000-00-00'`; strict mode rejects it, but old data survives upgrades and breaks every migration out.
- Division by zero: PostgreSQL, SQL Server, and SQLite raise an error; MySQL returns NULL unless `ERROR_FOR_DIVISION_BY_ZERO` is in `sql_mode`.
- Out-of-range numerics: error in PostgreSQL, clamped or rejected in MySQL depending on mode.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · dialects.md (reported line 151)May include surrounding context.

md

## Error Behavior on Bad Data

- Inserting a too-long string: PostgreSQL and SQL Server error; MySQL errors in strict mode (default since 5.7) and truncated without warning before that.
- Invalid dates: MySQL historically accepted `'0000-00-00'`; strict mode rejects it, but old data survives upgrades and breaks every migration out.
- Division by zero: PostgreSQL, SQL Server, and SQLite raise an error; MySQL returns NULL unless `ERROR_FOR_DIVISION_BY_ZERO` is in `sql_mode`.
- Out-of-range numerics: error in PostgreSQL, clamped or rejected in MySQL depending on mode.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · operations.md (reported line 253)May include surrounding context.

md

| Disk free on the data volume | < 20% warn, < 10% page | A full data volume can wedge the server entirely |
| Deadlocks per minute | Any sustained non-zero rate | Occasional is normal; a rate means a lock-order bug |
| Failed connections / auth errors | Any spike | Credential rotation gone wrong, or an attack |
| Inactive replication slots (PostgreSQL) | Any, immediately | Retains WAL forever and fills the disk with no warning |
| Backup job age | > 1 scheduled interval + margin | A failed backup job is otherwise discovered during the incident |

Alerting on CPU alone produces noise: databases are supposed to use CPU. Alert on the queue behind the CPU (waiting connections, transaction age) instead.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · patterns.md (reported line 336)May include surrounding context.

md

MySQL's `GROUP_CONCAT` truncates without warning at `group_concat_max_len` (1024 bytes by default) — a report that looks fine in testing loses data in production. Prefer returning rows and joining in the application, or aggregate to JSON where the engine supports it.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · datetime.md (reported line 108)May include surrounding context.

md

- Some local times do not exist (the spring-forward gap) and some occur twice (the autumn repeat). Converting a naive local time to an instant is therefore ambiguous or invalid for two hours a year; engines resolve it by rule, not by asking. Store the intended instant for anything that must not shift.
- A "day" is not always 24 hours: adding `INTERVAL '1 day'` in PostgreSQL adds a calendar day (23 or 25 hours across a transition), while adding `INTERVAL '24 hours'` adds exactly 24. Pick according to whether you mean "same time tomorrow" or "one day later".
- Scheduled jobs at 02:30 local never run on the spring-forward day and run twice on the autumn day. Schedule recurring jobs in UTC.
- Durations computed by subtracting local times cross transitions incorrectly. Subtract instants.
- Zone rules change: countries abolish DST, shift offsets, and split zones. The tzdata package must be updated on database servers too, not only on application hosts.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · debug.md (reported line 91)May include surrounding context.

md

| "connection refused" | Server not listening on that address, or wrong port | Check bind address and port before credentials |
| "no pg_hba.conf entry" / "Host is not allowed" | Host-based auth rules, not a bad password | Fix the auth rule for the client's network |
| "password authentication failed" for one app only | Different role than you tested with, or a rotated secret | Compare the role, not the password |
| "SSL required" / cert errors | Managed providers force TLS | Set the driver's SSL mode; do not disable verification to move on |
| Connections work then die after minutes | Idle timeout in a proxy/load balancer below the pool's `max_lifetime` | Set pool `max_lifetime` under the infrastructure timeout |
| Intermittent failures under load only | Pool exhaustion — waiters timing out, not the database refusing | Instrument pool wait time before touching the server |

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · modeling.md (reported line 22)May include surrounding context.

md

| 1:N | FK on the **many** side | Putting an array of child ids on the parent, which no FK can validate |
| M:N | Junction table with a composite PK | A comma-separated string column; every query becomes `LIKE` and nothing is enforceable |
| Optional 1:N | Nullable FK on the many side | Sentinel `0`/`-1` instead of NULL, which breaks the FK |
| Self-referencing | Nullable FK to the same table | No cycle guard; recursive reads then loop forever |

Ask "can this ever be more than one?" for every 1:1 and "will it always be exactly one?" for every required FK. Both answers change over the product's life, and the M:N junction is cheap to build up front and expensive to retrofit.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The file’s natural-language guidance and SQL examples repeatedly fix text search configuration to 'english', which imposes a specific language/locale behavior. Because the document is presented as general schema guidance rather than an explicitly English-only or region-specific tool, this can violate language/locale policy by steering implementations toward a forced locale without user opt-in.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · setup.md (reported line 27)May include surrounding context.

md

- User expresses a habit or stance (how much confirmation destructive DDL needs, whether triggers are allowed, whether every migration needs a down script) → record it under the relevant preference area (tooling, conventions, platform, safety posture, output format, work order, integrations, constraints, thresholds, cadence) in `~/Clawic/data/sql/memory.md`.
- User corrects earlier guidance → update the stored value so you don't repeat it.

If the user has said nothing, store nothing. An observation never overwrites a declared preference without asking.

## What Memory Holds

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

This markdown file provides executable SQL examples that delete duplicate rows from users, but the surrounding text does not explicitly warn readers that running these statements will permanently remove data if used incorrectly. Although there is a note to find duplicates first, that is operational guidance rather than a clear user-facing warning about destructive impact.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The Bulk Operations section recommends chunked DELETEs and table rebuild/drop patterns, all of which can remove large amounts of data or discard tables. The section discusses performance characteristics but does not clearly warn users about irreversible data loss or the need for backups/validation before execution.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.