ClawHub
Back to skill

Security audit

neo4j-cypher-query-analyze

Security checks across malware telemetry and agentic risk

Overview

This is a coherent Neo4j query helper, but it should only be used with database credentials and data the user is comfortable letting an agent inspect.

Install only if you want the agent to query the configured Neo4j or graph database. Use a dedicated read-only account, prefer HTTPS/TLS endpoints, avoid admin or production credentials, review generated Cypher before execution, and clear cached schema memory if labels, properties, or sampled fields are sensitive.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The skill instructs automatic schema discovery and sample-node retrieval without requiring explicit user consent or warning that metadata and sample records will be accessed. In real deployments, schema details, labels, property keys, and sampled rows can reveal sensitive business structure or personal data even before the user has asked for specific records.

External Transmission

Medium
Category
Data Exfiltration
Content
**HTTP API 调用模板：**
```bash
# Neo4j HTTP API
curl -s -X POST \
 -H "Content-Type: application/json" \
 -H "Accept: application/json" \
 -u "${GRAPHDB_USER}:${GRAPHDB_PASSWORD}" \
Confidence
91% confidence
Finding
curl -s -X POST \ -H "Content-Type: application/json" \ -H "Accept: application/json" \ -u "${GRAPHDB_USER}:${GRAPHDB_PASSWORD}" \ "${GRAPHDB_URI}/db/${GRAPHDB_DATABASE}/tx/commit" \ -d

External Transmission

Medium
Category
Data Exfiltration
Content
2. **Schema 探测执行**
  ```bash
  # 获取标签
  curl ... -d '{"statements":[{"statement":"CALL db.labels() YIELD label RETURN collect(label) AS labels"}]}'
  # 返回: ["Person", "Company", "Product", "Department"]

  # 获取关系类型
Confidence
89% confidence
Finding
curl ... -d '{"statements":[{"statement":"CALL db.labels() YIELD label RETURN collect(label) AS labels"}]}' # 返回: ["Person", "Company", "Product", "Department"] # 获取关系类型 curl ... -d '{"statemen

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.