Backup Recovery Toolkit

• Outcome: Review
• Latest audit: May 28, 2026 · 1:07 PM UTC
• Version: 1.0.0

Overview

This appears to be a genuine backup and restore toolkit, but it needs Review because its restore path can overwrite files and extract unsafe archives without enough safeguards.

Review before installing. Use a virtual environment or lockfile with pinned dependency versions, do not restore untrusted tar archives, restore into a staging directory first, verify source and destination paths carefully, and use least-privilege database credentials instead of root or production admin accounts.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (18)

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The backup and restore examples can modify or overwrite user data, but the documentation does not warn about destructive outcomes from incorrect source, destination, or backup paths. In a backup/recovery context this is materially dangerous because users may run commands against production data and accidentally overwrite current files or restore into the wrong location.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The Python API example embeds a plaintext database password directly in sample code without guidance on secure secret handling. This encourages insecure copy-paste practices, increasing the chance that credentials are hardcoded into scripts, committed to source control, or exposed in logs and shared environments.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The database backup routines handle plaintext credentials and pass them to external processes via command-line arguments or environment variables. This can expose secrets through process listings, crash dumps, child-process inheritance, logs, or other local inspection paths, especially on shared systems.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The restore logic extracts tar archives with tar.extractall(destination) without validating member paths, enabling path traversal via malicious archive entries. An attacker can craft a backup containing absolute paths or ../ segments to overwrite files outside the intended restore directory, which is especially dangerous in a backup/restore context where archives may be treated as trusted.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

schedule>=1.2.0
psutil>=5.9.6
pymysql>=1.1.0
psycopg2-binary>=2.9.9

• Confidence: 97% confidence
• Finding: The dependency is specified with a lower bound only, which allows future unreviewed versions to be installed and weakens build reproducibility. In a backup/recovery toolkit, this increases supply-chain and operational risk because infrastructure-facing code may pull in unexpected dependency changes during deployment.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

schedule>=1.2.0
psutil>=5.9.6
pymysql>=1.1.0
psycopg2-binary>=2.9.9
pymongo>=4.6.0

• Confidence: 98% confidence
• Finding: Using psutil with a non-exact version specifier allows installations to resolve to different versions over time, reducing reproducibility and making it easier to accidentally consume insecure or incompatible releases. Because this toolkit likely runs with elevated access to system metrics and processes, dependency drift is somewhat more dangerous than in a simple user application.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

schedule>=1.2.0
psutil>=5.9.6
pymysql>=1.1.0
psycopg2-binary>=2.9.9
pymongo>=4.6.0
paramiko>=3.3.1

• Confidence: 98% confidence
• Finding: The PyMySQL dependency is unpinned, so environments may install different versions depending on resolution time and mirror state. In a backup tool that connects to databases, unreviewed dependency changes can directly affect confidentiality and integrity of database backup operations.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

schedule>=1.2.0
psutil>=5.9.6
pymysql>=1.1.0
psycopg2-binary>=2.9.9
pymongo>=4.6.0
paramiko>=3.3.1
cryptography>=41.0.7

• Confidence: 97% confidence
• Finding: psycopg2-binary is declared with only a minimum version, which permits dependency drift and non-reproducible builds. For a tool that may back up PostgreSQL data, this can increase exposure to newly introduced defects or vulnerable transitive packaging artifacts.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

psutil>=5.9.6
pymysql>=1.1.0
psycopg2-binary>=2.9.9
pymongo>=4.6.0
paramiko>=3.3.1
cryptography>=41.0.7
pytest>=7.4.0

• Confidence: 98% confidence
• Finding: An unpinned PyMongo requirement allows installation of varying versions over time, which is a supply-chain hygiene issue and undermines reproducibility. Since this skill appears to back up databases, MongoDB connectivity is security-sensitive and version drift can materially affect data handling and parser safety.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pymysql>=1.1.0
psycopg2-binary>=2.9.9
pymongo>=4.6.0
paramiko>=3.3.1
cryptography>=41.0.7
pytest>=7.4.0
pytest-cov>=4.1.0

• Confidence: 99% confidence
• Finding: Paramiko is a network-facing SSH library, and leaving it unpinned increases the chance of consuming unsafe or incompatible versions without review. In an enterprise backup/recovery toolkit, SSH is commonly used for remote access and transfers, so dependency drift here is more dangerous than average.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

psycopg2-binary>=2.9.9
pymongo>=4.6.0
paramiko>=3.3.1
cryptography>=41.0.7
pytest>=7.4.0
pytest-cov>=4.1.0

• Confidence: 99% confidence
• Finding: cryptography is a highly security-sensitive library, and specifying only a minimum version permits unreviewed upgrades and inconsistent installations. In a backup product that may encrypt archives or transport channels, cryptographic dependency drift can directly impact confidentiality and integrity.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pymongo>=4.6.0
paramiko>=3.3.1
cryptography>=41.0.7
pytest>=7.4.0
pytest-cov>=4.1.0

• Confidence: 94% confidence
• Finding: pytest is a development/test dependency and leaving it unpinned can still reduce reproducibility and introduce tooling risk in CI environments. However, because it is typically not part of the runtime path for the backup service, the direct production impact is lower.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

paramiko>=3.3.1
cryptography>=41.0.7
pytest>=7.4.0
pytest-cov>=4.1.0

• Confidence: 94% confidence
• Finding: pytest-cov is a testing dependency, and an unpinned specifier mainly creates CI reproducibility and supply-chain hygiene concerns. It is less dangerous than runtime libraries here, but still should not float freely in controlled enterprise builds.

Known Vulnerable Dependency: pymysql — 1 advisory(ies): CVE-2024-36039 (PyMySQL SQL Injection vulnerability)

Critical

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: The scanner reports a critical PyMySQL advisory, and the dependency is only lower-bounded, so vulnerable affected versions may still satisfy the requirement depending on the advisory's patched threshold. In a backup toolkit that connects to production databases, a client-library flaw associated with SQL injection or unsafe query handling could expose sensitive data or enable unauthorized database operations.

Known Vulnerable Dependency: pymongo — 3 advisory(ies): CVE-2024-5629 (PyMongo Out-of-bounds Read in the bson module ); CVE-2013-2132 (Use of NullPointerException Catch to Detect NULL Pointer Dereference in Pymongo); CVE-2013-2132 (bson/_cbsonmodule.c in the mongo-python-driver (aka. pymongo) before 2.5.2, as u)

High

• Category: Supply Chain
• Confidence: 85% confidence
• Finding: PyMongo is flagged with multiple advisories, and because the package is not pinned to a known-safe exact version, a resolver could select an affected release within the allowed range. This toolkit's database-backup context increases the seriousness because BSON parsing or driver-level memory issues may be reachable when handling untrusted or malformed database content.

Known Vulnerable Dependency: paramiko — 10 advisory(ies): CVE-2018-7750 (Paramiko not properly checking authentication before processing other requests); CVE-2023-48795 (Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terr); CVE-2018-1000805 (Paramiko Authentication Bypass vulnerability) +7 more

Critical

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: Paramiko is associated with numerous serious SSH-related advisories, and the permissive version specifier means affected versions could be installed if they satisfy the lower bound. In a backup/recovery toolkit, SSH is often used for remote backup transfer or orchestration, so an exploitable flaw here could compromise credentials, session integrity, or remote systems.

Known Vulnerable Dependency: cryptography — 10 advisory(ies): GHSA-39hc-v87j-747x (Vulnerable OpenSSL included in cryptography wheels); CVE-2023-50782 (Python Cryptography package vulnerable to Bleichenbacher timing oracle attack); GHSA-5cpq-8wj7-hf2v (Vulnerable OpenSSL included in cryptography wheels) +7 more

High

• Category: Supply Chain
• Confidence: 87% confidence
• Finding: The cryptography package is flagged for multiple advisories, and the open-ended requirement allows a wide range of versions unless constrained elsewhere. Because this toolkit likely relies on encryption for stored backups or transport security, cryptographic library flaws can directly undermine confidentiality, integrity, and trust guarantees.

Known Vulnerable Dependency: pytest — 1 advisory(ies): CVE-2025-71176 (pytest has vulnerable tmpdir handling)

Low

• Category: Supply Chain
• Confidence: 72% confidence
• Finding: pytest is a development dependency, and although the cited advisory is low severity, keeping a vulnerable test framework in CI can still expose build environments or taint test artifacts. The impact is limited because this is not likely part of the production runtime for the backup toolkit.

Static analysis

No suspicious patterns detected.