KWDB Intelligent Inspection

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:45 AM UTC
• Version: 1.2.1

Overview

This skill performs disclosed KaiwuDB health inspection and metric reporting, with user confirmation gates before probing or collecting data.

Install only if you intend to inspect KaiwuDB clusters. Run it against hosts you administer, preferably over trusted networks or tunnels, and treat generated reports and raw JSON as sensitive because they may include SQL text, usernames, database names, and error details.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (15)

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The single-word trigger '巡检' is extremely vague and likely to collide with ordinary conversation or unrelated inspection tasks. Because this skill can lead to connectivity probing and script execution, such ambiguous activation materially raises the risk of unintended operational actions against user-supplied hosts or internal systems.

Ae1

High

• Category: analysis-evasion

Content

- `references/ts-metrics-script-usage.md` — for `get_kwdb_ts_metrics.py`

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- `references/ts-metrics-script-usage.md` — for `get_kwdb_ts_metrics.py`

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

**Must strictly use this exact command format, only replace `<host>` and `<admin-port>` with actual values:**
```
curl -k https://<host>:<admin-port>/health
```
- If output contains `error:0A00010B` or `wrong version number` → TLS not enforced, proceed
- If returns JSON health data with no error → TLS enabled, **inspection not supported** (stop here)

• Confidence: 60% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

## Output Rules

❝ **Never produce an inspection report unless it follows the format defined in `references/report-template.md`.** The report must use the Required Report Sections 1-6 structure, include all metrics listed under each section, and use the API Name column values for metric references. Deviating from this template is forbidden. ❞

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

## Output Rules

❝ **Never produce an inspection report unless it follows the format defined in `references/report-template.md`.** The report must use the Required Report Sections 1-6 structure, include all metrics listed under each section, and use the API Name column values for metric references. Deviating from this template is forbidden. ❞

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill invokes shell-capable workflows and references local scripts, but it does not declare any explicit tool scope such as allowed-tools or permissions. That creates an authorization gap where an agent may execute shell actions more broadly than intended, increasing the chance of unintended command execution or environmental access during a database inspection flow.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger 'check database health' is broad and can match many unrelated database-support requests, potentially activating this skill outside KaiwuDB-specific contexts. Accidental activation is risky here because the skill is designed to probe hosts, ports, and collect operational metrics, which could lead to unnecessary network actions or disclosure of infrastructure details.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger 'kwdb inspection' is somewhat clearer than generic database terms, but still broad enough to capture requests that do not intend script-backed health checks or network probing. In this skill's context, accidental invocation matters because the workflow includes connectivity checks and scripted metric collection against infrastructure targets.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The Chinese trigger '数据库指标' is too broad and not tied to KaiwuDB, so it can match generic requests for database metrics across many products. In a skill that performs host/port probing and script-driven metric collection, this increases the chance of cross-product misuse or accidental execution in the wrong environment.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation explicitly points users to an `http://<host>:8080/_status/statements` endpoint and notes that TLS mode is not supported, but it does not warn that this endpoint can expose sensitive SQL statement text, usernames, database names, and error details in cleartext. In a database inspection skill, this omission is meaningful because operators may run the tool against real production systems and unintentionally transmit or display sensitive metadata over an unencrypted channel.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"--insecure",
        f"http://{host}:{port}/_status/statements"
    ]
    result = subprocess.run(curl_cmd, capture_output=True, text=True)
    if result.returncode != 0:
        print(f"Error: Failed to fetch statements: {result.stderr}", file=sys.stderr)
        sys.exit(1)

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The --json mode prints the full statements API response, which can contain raw SQL text, usernames, database names, and sensitive error details such as lastErr. In an inspection skill whose purpose is to collect and display database telemetry, this increases the likelihood of exposing confidential data to users, logs, chat transcripts, or downstream systems without redaction or warning.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

]

    try:
        result = subprocess.run(curl_cmd, capture_output=True, text=True, timeout=30)
    except subprocess.TimeoutExpired:
        print("Error: Connection to KaiwuDB timed out (30s)", file=sys.stderr)
        sys.exit(1)

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Overly Broad Trigger

Low

• Category: Trigger Abuse
• Confidence: 95% confidence
• Finding: The trigger '巡检' is overly short and can be matched by many benign user inputs unrelated to KaiwuDB. While this overlaps with the broader trigger-quality issue, the shortness specifically increases accidental routing frequency, which is dangerous in a skill capable of network checks and shell-backed inspection steps.

Static analysis

No suspicious patterns detected.