KWDB Data Migration

• Outcome: Review
• Latest audit: Aug 28, 2026 · 1:02 AM UTC
• Version: 1.2.1

Overview

This skill is a real KaiwuDB migration helper, but it normalizes pasting and saving database credentials and can perform live schema and data-changing operations with weak built-in safeguards.

Install only if you are comfortable using this skill with database administrator-level operations. Use temporary least-privilege database accounts, avoid pasting real passwords or tokens into chat, prefer localhost or HTTPS-only KDTS endpoints, review generated DDL and target database names before execution, back up source and target data, and do not save exported configs with live credentials unless they are protected outside the skill.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (36)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill describes and encourages use of environment variables, local config files, Python scripts, shell commands, and outbound HTTP requests, yet it declares no permissions or trust boundaries. That creates a capability/expectation mismatch: an agent may access network, files, environment secrets, or shell-like execution paths without explicit user awareness or policy gating.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The trigger guidance is broad enough to activate on generic requests about transferring or syncing data between databases, even when the user did not ask to use KDTS or this particular migration workflow. Over-broad auto-invocation can cause the agent to collect credentials unnecessarily, steer users into high-impact operations, or expose this skill in contexts where a safer or narrower tool should be used.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to ask the user for raw database usernames and passwords directly in chat, but it does not provide clear privacy handling, masking, storage minimization, or safer alternatives. This is dangerous because credentials may be logged in conversation history, leaked to other tools, or reused against production systems if mishandled.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The checklist instructs users to send raw database credentials, including passwords, in example HTTP API payloads without any warning about transport security, secret redaction, or log exposure. In a migration skill, this is especially risky because operators may copy the examples verbatim, potentially transmitting production credentials over insecure channels or exposing them in agent logs, shell history, or ticketing systems.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The document advises dropping existing target tables as part of DDL execution but does not present a prominent irreversible-data-loss warning at the point of action. In an operational migration skill, users may execute destructive steps quickly, and missing inline warnings increase the chance of accidental deletion of live or partially migrated data.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The migration execution section tells users how to start DataX jobs but does not warn that execution will write to the target database and may leave partial writes if the job later fails or times out. This is dangerous in a data-migration context because operators may assume failure is atomic, leading to duplicate loads, inconsistent state, or accidental corruption during retries.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger list includes generic verbs like 'import', 'export', 'sync', and 'transfer' plus broad scenario terms, which can cause the migration skill to activate on unrelated requests. In an agent environment, unintended activation can lead to inappropriate collection of database credentials, execution of migration-oriented actions, or user confusion about why a high-privilege data-movement skill was invoked.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The example config explicitly stores source and target usernames and passwords in plaintext JSON and presents save/load as a normal workflow without any warning or protection guidance. This creates a direct secret-exposure risk through local files, logs, backups, source control, shared workspaces, or accidental reuse, especially because migration workflows routinely handle privileged database accounts.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger keyword section includes very broad terms such as common migration verbs and generic scenario descriptions, which can cause the skill to activate for loosely related requests. In an agent environment, overbroad activation increases the chance that sensitive database-oriented workflows, parameter collection, or operational guidance are invoked in the wrong context, potentially causing unintended handling of credentials or destructive operations.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The configuration example explicitly shows plaintext usernames and passwords being exported into a JSON file, but the document does not warn about credential exposure at rest. In a migration skill, saved configs are likely to be shared, backed up, logged, or stored on disk, creating a realistic path to database credential leakage and downstream compromise of source and target systems.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The scenario instructs users to paste database usernames, passwords, and service endpoints directly into the chat transcript. Even though the document includes a backup warning, it does not warn that secrets placed in conversation history may be logged, retained, exposed to operators, or echoed back by the agent, which creates a realistic credential-handling weakness.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: Later examples continue the same insecure pattern by requesting and displaying tokens and passwords inline, including high-value API tokens for InfluxDB. In a migration skill, these credentials typically grant broad read/write access to production data sources and targets, so exposing them in prompts, transcripts, or logs increases the chance of credential compromise and follow-on unauthorized access.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The API reference documents `/metadata/execute` as directly executing DDL against a target KaiwuDB instance, but it does not prominently warn that this changes schema state and may create or overwrite database objects. In a migration skill, users may treat the document as safe reference material and trigger schema changes on production targets without adequate confirmation, environment scoping, or rollback planning.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The `/datax/execute` endpoint is presented as a normal execution step without a strong warning that it initiates live data movement and may write into or duplicate data on the target system. Because this skill is specifically for heterogeneous database migration, the operational context increases the risk that users or agents will run it against real environments and cause unintended data modification or migration jobs at scale.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The documentation includes directly usable DDL execution and task-kill request examples without prominent safety guidance, confirmation requirements, or warnings about destructive effects. In an agent skill context, this can normalize or encourage execution of schema-changing and task-terminating operations from generated workflows, increasing the chance of accidental database modification, interruption of active migrations, or misuse against production systems.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation explicitly recommends restarting the KDTS service or force-killing the process with `kill -9` during troubleshooting, but it does not warn about service interruption, possible in-flight migration failure, or state corruption risk. In an operational migration skill, such instructions can directly lead users to disrupt running data transfer jobs or lose diagnostic context, especially because `kill -9` prevents graceful shutdown.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The file provides package installation and configuration-change instructions, followed by service restart guidance, without clearly warning that these commands modify the host system and may affect production availability. In a migration-operations context, operators may copy/paste them onto shared servers, causing unintended changes or outages.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The document includes configuration examples with a populated `password` field (for example, `"password": "secret"`) but does not warn users to avoid pasting real credentials into docs, chats, logs, or version control. In a database migration skill, operators frequently work with production systems and may copy these examples directly, increasing the risk of accidental secret exposure through transcripts, config exports, screenshots, or repositories.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README advertises schema preview/execution and full migration workflows but does not clearly warn that these operations can create, alter, or populate target databases. In an agent-executed skill context, this omission increases the chance of unintended destructive or unauthorized changes because operators may treat examples as safe defaults and trigger write-capable actions without explicit confirmation.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The examples embed realistic plaintext usernames, passwords, hosts, and database names without any guidance on secret handling. Even if illustrative, this normalizes insecure practices and can lead users or downstream agents to hardcode credentials in code, logs, prompts, or version control, increasing the likelihood of credential leakage and unauthorized database access.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The client sends database credentials in JSON bodies over whatever base URL is configured, and the documented/default configuration allows plain HTTP (for example, http://127.0.0.1:8989). If the KDTS endpoint is remote or traffic crosses an untrusted network, usernames and passwords can be intercepted or logged in transit, and the code does not enforce TLS or warn callers about this exposure.

Missing User Warnings

Low

• Confidence: 96% confidence
• Finding: The example test block hardcodes sample usernames and passwords in plaintext. Even though these appear to be illustrative credentials, embedding secrets-like values in source code normalizes insecure practices, risks accidental reuse in real environments, and may lead to credential leakage through logs, screenshots, repositories, or copied examples. In a database migration skill, this is somewhat more sensitive because users are likely to handle real database credentials and may imitate the example directly.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: When an API client is present, test_connection forwards the full configuration object, including credentials, to a remote KDTS endpoint without any user-facing warning, consent checkpoint, or data minimization at this call site. In a migration skill, that is meaningful because configs commonly contain sensitive secrets and internal host details, so an unsuspecting caller may trigger transmission of credentials to an external service.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The full migration workflow executes target-side DDL automatically unless an external confirmation callback is supplied. In an agentic context, this enables schema-changing actions to occur without an explicit built-in consent gate, increasing the risk of accidental or unauthorized destructive changes when user intent is ambiguous or prompts are manipulated.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The workflow submits migration scripts directly to the target system without a native confirmation or destructive-operation warning. Because migration can overwrite, duplicate, or otherwise materially alter target data, automatic execution is risky in a skill designed to be triggered from natural-language requests.

Static analysis

No suspicious patterns detected.