T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:59- Finding
Full-record schema sampling violates least privilege and may expose sensitive graph data
- Content
View full analysis
- Remediation
View remediation
Security audit
neo4j-cypher-query-analyze
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent Neo4j query helper, but it automatically probes and samples live database records and relies on weak execution safeguards for sensitive database access.
Review before installing, especially for production or sensitive graph databases. Use a dedicated read-only Neo4j account with restricted labels, properties, and procedures; require query preview/approval before schema discovery; avoid full-record sampling; require HTTPS to a trusted endpoint; and do not let raw query responses or credentials enter logs or persistent memory.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:184- Finding
Graph database credentials are exposed through command arguments and unrestricted transport configuration
- Content
View full analysis
&1 ``` ### Technical Analysis Passing `${GRAPHDB_USER}:${GRAPHDB_PASSWORD}` through `curl -u` places the expanded credentials in the process argument vector. Depending on operating-system configuration, container isolation, process-monitoring software, shell tracing, and local user permissions, command arguments may be observable through process inspection or telemetry. The endpoint is constructed directly from `GRAPHDB_URI`, with no documented enforcement of HTTPS, approved hosts, certificate verification policy, or redirect restrictions. If the URI is configured with plaintext HTTP, credentials are transmitted without transport encryption. If an attacker or misconfiguration controls the URI, the Skill may authenticate to an unintended server and disclose reusable graph database credentials. The bundled `.env` contains placeholder values rather than confirmed live credentials. Nevertheless, the execution template is designed to process real credentials at runtime, and the documentation references a credential-bearing file at: ```text ~/.openclaw/skills/graphdb-schema-aware-query/.env ``` Access to that specific credential source is functionally necessary for database authentication, but credential exposure through process arguments and unconstrained endpoint configuration is not. ### Attack Path #### Local process-observation path 1. A user configures valid graph data ...[truncated 1523 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:161- Finding
Keyword-based Cypher guardrail can permit write-capable or privileged procedure execution
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill explicitly says it will automatically probe database schema on first use, which can access and transmit metadata without an explicit user-facing consent or warning. Schema metadata, labels, property keys, and topology can be sensitive in enterprise environments because they reveal data models, business entities, and attack surface even when no row data is returned.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The examples instruct the agent to sample live nodes and relationships to infer properties, which can expose real record contents during automatic operation. Sampling 'RETURN n LIMIT 1' and relationship inspection may retrieve sensitive fields from production data, making this more dangerous than pure schema introspection because it touches actual data values.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
The skill provides a concrete curl template that sends generated Cypher queries and potentially returned data to a remote database endpoint using credentials from environment variables. External transmission is inherent to database access, but it becomes a security issue here because the skill encourages automatic execution and data retrieval without strong consent boundaries, endpoint validation guidance, or minimization of returned content.
- Content
HTTP API 调用模板：
bash # Neo4j HTTP API curl -s -X POST \ -H "Content-Type: application/json" \ -H "Accept: application/json" \ -u "${GRAPHDB_USER}:${GRAPHDB_PASSWORD}" \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The worked example normalizes repeated remote curl-based schema and data sampling requests, showing how the skill would automatically transmit metadata requests and retrieve live node samples from the database. In context, this increases operational risk because it makes non-interactive probing of a potentially sensitive graph database part of the default workflow.
- Content
- Schema 探测执行
bash # 获取标签 curl ... -d '{"statements":[{"statement":"CALL db.labels() YIELD label RETURN collect(label) AS labels"}]}' # 返回: ["Person", "Company", "Product", "Department"] # 获取关系类型