Security audit
Security checks for vulnerabilities and agentic risk
This skill performs disclosed KaiwuDB health inspection and metric reporting, with user confirmation gates before probing or collecting data.
Install only if you intend to inspect KaiwuDB clusters. Run it against hosts you administer, preferably over trusted networks or tunnels, and treat generated reports and raw JSON as sensitive because they may include SQL text, usernames, database names, and error details.
The single-word trigger '巡检' is extremely vague and likely to collide with ordinary conversation or unrelated inspection tasks. Because this skill can lead to connectivity probing and script execution, such ambiguous activation materially raises the risk of unintended operational actions against user-supplied hosts or internal systems.
Referenced artifact was not completely inspected
- `references/ts-metrics-script-usage.md` — for `get_kwdb_ts_metrics.py`
Referenced artifact was not completely inspected
- `references/ts-metrics-script-usage.md` — for `get_kwdb_ts_metrics.py`
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Must strictly use this exact command format, only replace <host> and <admin-port> with actual values:
curl -k https://<host>:<admin-port>/health
error:0A00010B or wrong version number → TLS not enforced, proceedSkill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
## Output Rules
❝ **Never produce an inspection report unless it follows the format defined in `references/report-template.md`.** The report must use the Required Report Sections 1-6 structure, include all metrics listed under each section, and use the API Name column values for metric references. Deviating from this template is forbidden. ❞
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
## Output Rules
❝ **Never produce an inspection report unless it follows the format defined in `references/report-template.md`.** The report must use the Required Report Sections 1-6 structure, include all metrics listed under each section, and use the API Name column values for metric references. Deviating from this template is forbidden. ❞
The skill invokes shell-capable workflows and references local scripts, but it does not declare any explicit tool scope such as allowed-tools or permissions. That creates an authorization gap where an agent may execute shell actions more broadly than intended, increasing the chance of unintended command execution or environmental access during a database inspection flow.
The trigger 'check database health' is broad and can match many unrelated database-support requests, potentially activating this skill outside KaiwuDB-specific contexts. Accidental activation is risky here because the skill is designed to probe hosts, ports, and collect operational metrics, which could lead to unnecessary network actions or disclosure of infrastructure details.
The trigger 'kwdb inspection' is somewhat clearer than generic database terms, but still broad enough to capture requests that do not intend script-backed health checks or network probing. In this skill's context, accidental invocation matters because the workflow includes connectivity checks and scripted metric collection against infrastructure targets.
The Chinese trigger '数据库指标' is too broad and not tied to KaiwuDB, so it can match generic requests for database metrics across many products. In a skill that performs host/port probing and script-driven metric collection, this increases the chance of cross-product misuse or accidental execution in the wrong environment.
The documentation explicitly points users to an http://<host>:8080/_status/statements endpoint and notes that TLS mode is not supported, but it does not warn that this endpoint can expose sensitive SQL statement text, usernames, database names, and error details in cleartext. In a database inspection skill, this omission is meaningful because operators may run the tool against real production systems and unintentionally transmit or display sensitive metadata over an unencrypted channel.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
"--insecure",
f"http://{host}:{port}/_status/statements"
]
result = subprocess.run(curl_cmd, capture_output=True, text=True)
if result.returncode != 0:
print(f"Error: Failed to fetch statements: {result.stderr}", file=sys.stderr)
sys.exit(1)
The --json mode prints the full statements API response, which can contain raw SQL text, usernames, database names, and sensitive error details such as lastErr. In an inspection skill whose purpose is to collect and display database telemetry, this increases the likelihood of exposing confidential data to users, logs, chat transcripts, or downstream systems without redaction or warning.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
]
try:
result = subprocess.run(curl_cmd, capture_output=True, text=True, timeout=30)
except subprocess.TimeoutExpired:
print("Error: Connection to KaiwuDB timed out (30s)", file=sys.stderr)
sys.exit(1)
The trigger '巡检' is overly short and can be matched by many benign user inputs unrelated to KaiwuDB. While this overlaps with the broader trigger-quality issue, the shortness specifically increases accidental routing frequency, which is dangerous in a skill capable of network checks and shell-backed inspection steps.