DB Smart Import

• Outcome: Review
• Latest audit: May 29, 2026 at 9:32 PM UTC
• Version:
  1.0.0

Overview

This database import skill is legitimate in purpose, but it can execute SQL dumps directly against live databases without strong safeguards or clear warnings about destructive SQL.

Install only if you are comfortable with a skill that can permanently change databases. Use it first on staging or a fresh restore, back up the target database, inspect SQL dumps as executable code, avoid root or admin database users, and do not pass real passwords directly on the command line when safer credential handling is available.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence
• Finding: The documentation markets the skill as a smart importer/parser, but it also instructs users to execute SQL dump files directly against databases. That expands the risk from data ingestion to arbitrary SQL execution, which can drop tables, alter privileges, destroy data, or trigger dangerous database-side behaviors if the dump is untrusted. The mismatch makes users more likely to underestimate the danger.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation tells users how to execute SQL dumps on live databases without clearly warning that a .sql file can contain arbitrary SQL, not just inserts or schema creation. In this skill's context, users may import third-party or migrated dumps, so treating them as ordinary data files is especially dangerous and can lead to irreversible modification or destruction of existing databases.

VirusTotal

66/66 vendors flagged this skill as clean.