Workspace Database Manager

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:48 AM UTC
• Version: 1.0.0

Overview

The skill is a workspace indexing helper, but its optional setup tells users to install an unreviewed updater that creates a recurring cron job.

Install only if you are comfortable with broad workspace indexing and local database/export files being created or updated. Avoid the optional db-maintainer cron setup unless you have separately reviewed and pinned that package, understand the exact scheduled command, and know how to remove it.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T06 · System Persistence

Error

• Location: INSTALL.md:23

Finding

Unaudited External Maintainer Installs a Persistent Scheduled Task

Content

View full analysis

Vulnerability Details

File Location: INSTALL.md, lines 23-28
Vulnerability Type: External dependency execution and system persistence
Risk Level: High

markdown

## Schritt 3: Optional - Maintainer installieren

Für automatische Updates:
```bash
clawhub install db-maintainer
python3 skills/db-maintainer/scripts/install_cron.py

text

### Technical Analysis

The installation guide directs users to download the external `db-maintainer` Skill and immediately execute its `install_cron.py` script. That dependency and its installer are not included in the audited artifact, so their source code, integrity, permissions, scheduled command, and update behavior cannot be verified.

The stated purpose is to enable automatic updates, while `README.md`, line 65, describes a 30-minute update interval. Executing a cron installer creates a cross-session scheduled execution mechanism. Because the external package is not pinned to an immutable version or verified by a checksum or signature, its effective behavior may depend on whichever package version the registry supplies at installation time.

No evidence in the submitted files establishes that `db-maintainer` is itself malicious. The security issue is that the documented workflow delegates recurring local execution to an unaudited, unpinned external component.

### Attack Path

1. A user follows the optional automatic-update instructions in `INSTALL.md`.
2. `clawhub install db-maintainer` retrieves a package that is outside the audited artifact.
3. The user executes `skills/db-maintainer/scripts/install_cron.py`.
4. The external installer creates a recurring cron task intended to survive the current Skill invocation.
5. The installed dependency subsequently executes at the configured interval.
6. If the external package source, registry account, release process, or delivered version is compromised, attacker-controlled code could execute repeatedly under the account that installed the task.

### Impact Ass
...[truncated 673 chars]

Remediation

View remediation

Remediation Suggestions

1. Include the complete db-maintainer implementation in the audited distribution, or require a separate security review before installation.
2. Pin the dependency to an immutable, trusted version rather than installing an unspecified latest release.
3. Verify the downloaded package using a trusted cryptographic signature or published checksum.
4. Display the exact cron entry, executable path, arguments, frequency, working directory, and environment before installation.
5. Require explicit user confirmation immediately before creating the scheduled task.
6. Run the maintenance process with the minimum filesystem and database permissions required.
7. Avoid executing code from package directories that can be modified by less-trusted users or processes.
8. Provide a documented uninstall command that removes both the cron entry and associated installed files.
9. Prefer an opt-in foreground update command where recurring execution is not essential.
10. Record installation and update events so users can identify unexpected changes to the scheduled task or dependency.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

docs.db

sql

documents: id, name, path, category, description, type, has_symlink, symlink_path, last_update
skills: id, name, version, status, description, path
symlinks: id, name, target, source_path, description
categories: id, name, description, priority

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This markdown file uses German headings and instructions throughout, such as 'Voraussetzungen', 'Schritt', and 'Lösung'. Under the policy rule, forcing a specific language without user opt-in can be a natural-language policy violation when no alternative language option or justification is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README content is presented in German ('SQLite-basierte Dokumentations-Verwaltung') with no indication that other languages are supported or that German is an intentional, documented locale constraint. This can violate language/locale policy when users are not given a choice or opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly instructs users to run indexing scripts and states that exports are auto-generated in the workspace root, but it does not warn that this operation modifies the workspace by creating or updating databases and export files. This is a real safety/documentation issue because users may assume the skill is read-only and unintentionally alter tracked files or clutter the root directory.

Content

No source excerpt is available for this finding.