Security audit
Security checks for vulnerabilities and agentic risk
The skill is not deceptive or executable, but it gives under-scoped advice for cluster-wide database settings and schema-changing SQL despite claiming those areas are out of scope.
Review this skill before installing if you only wanted SQL query review. It can produce useful KWDB performance advice, but it also teaches cluster-wide configuration and schema-changing actions. Treat any SET CLUSTER SETTING, CREATE INDEX, DROP INDEX, or ANALYZE output as DBA-reviewed change-management material, not routine assistant advice.
The trigger list includes broad phrases like 'performance', 'slow query', and related generic wording that can match many ordinary database conversations. Over-broad activation can invoke this skill in the wrong context, leading to irrelevant or unsafe advice, especially where the skill may drift into config tuning or engine-specific recommendations without sufficient confirmation.
Several activation examples are ambiguous and insufficiently constrained, making unintended invocation plausible. In this skill, that matters because mistaken activation could push users toward KaiwuDB-specific query or cluster-setting guidance when they asked a broader database or application-performance question.
The documentation first excludes deployment/configuration questions, then later instructs configuration optimization and cluster-setting review. Such contradictory instructions weaken safety boundaries because an agent may follow the more detailed later workflow and provide operationally sensitive advice despite the earlier prohibition.
The skill metadata and scope statements say deployment/configuration are out of scope, but the body later introduces cluster-setting review and configuration tuning workflows. This inconsistency can cause the agent to engage in higher-risk operational guidance outside its declared boundary, increasing the chance of unsafe activation and user confusion around whether infrastructure-level advice is permitted.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
6. **Explain WHY the optimization works** - not just what to change
7. **Validate with EXPLAIN** before finishing
8. **Confirm memory and disk before config changes** - never suggest cache/memory size increases without confirmed free resources
9. **Never auto-execute SET CLUSTER SETTING** - only provide SQL for user to review
10. **Never use SHOW CLUSTER SETTINGS** - always query specific settings individually
11. **Resource overload reduce warning** - when recommending reduced values for memory/CPU-impact parameters, always include the risk warning about potential performance degradation
The skill is explicitly scoped to SQL query performance review and excludes DDL, schema design, deployment, and DML writes, yet this template shifts the workflow into cluster configuration tuning. That can cause the agent to provide infrastructure-level advice outside its declared competence and safety boundary, increasing the chance of unsafe or irrelevant recommendations that affect the whole cluster rather than a single query.
The template includes concrete SET CLUSTER SETTING statements, enabling the skill to recommend direct modification of global database settings even though the skill's stated purpose is performance review of SQL queries. In context, this is more dangerous because cluster settings are high-impact, affect all workloads, and can degrade performance, increase resource consumption, or destabilize production if applied without proper operational review.
This example instructs the user to execute cluster-wide configuration changes even though the skill is scoped to query performance review and explicitly not for broader operational changes. In an agent setting, this can cause the skill to overstep its intended authority and steer users toward persistent system-level modifications with availability, performance, and resource tradeoff consequences beyond a single query review.
These examples repeatedly recommend modifying storage compression, cache sizing, and compaction behavior, which are cluster-wide operational controls rather than query-review outputs. Because the skill is framed as performance advice, users may apply these commands without appreciating their blast radius, leading to degraded write throughput, increased memory pressure, altered IO patterns, or broader service instability.
The examples apply the delegation boundary inconsistently: one schema change is explicitly delegated to another skill, while another example later recommends direct index creation. This inconsistency is dangerous because it weakens policy enforcement and can train an agent to sometimes ignore scope limits, leading to unauthorized or unreviewed schema changes.
The skill metadata explicitly says it is not for DDL or schema design, yet this example directly recommends CREATE INDEX, which is a schema-modifying operation. That boundary violation can cause an agent to perform out-of-scope database changes without proper review, increasing the risk of unsafe production modifications and bypassing intended delegation controls.
The manifest says this skill is for optimizing SQL query performance and explicitly says it is not for DDL, schema design, deployment, or DML writes, but this file provides broad database cluster configuration optimization guidance. It covers storage, compression, compaction, memory, write performance, disk cleanup, and cluster settings changes, which are materially different from EXPLAIN/query-plan-focused SQL tuning and broaden the skill into operational parameter tuning.
This reference exceeds the skill's declared read-only performance-analysis scope by recommending and showing mutating DDL operations such as CREATE INDEX and DROP INDEX. In an agent setting, that can cause the assistant to suggest or generate schema-changing actions that may disrupt production systems, create lock/contention issues, or remove needed indexes under the guise of performance tuning.
The pseudocode appends cursor_ts directly into the SQL string using interpolation, which teaches an unsafe query construction pattern. If a caller can influence the cursor value, this can lead to SQL injection or malformed queries, and the risk is elevated because the document is instructional guidance likely to be copied into production code.
The example function builds SQL by concatenating an unescaped cursor value into the WHERE clause without any safety guidance. In a performance-tuning skill, readers may treat the sample as best practice and reuse it, creating a realistic path to SQL injection in applications that expose pagination cursors to users or APIs.
The manifest says the skill is not for DDL or schema design, but this file recommends and demonstrates CREATE INDEX statements, which are DDL operations that modify database schema. It also later recommends ANALYZE, a maintenance command that changes optimizer statistics state rather than purely analyzing plans.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
### ttl_duration
Automatically removes old data to control table size. Delegate TTL changes to `kwdb-schema-design`.
**Benefits:**
- Automatic data cleanup
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
### TTL for Data Lifecycle
TTL automatically removes old data to control table size. Delegate TTL changes to `kwdb-schema-design`.
### DICT ENCODING for High-Cardinality Strings
The skill is explicitly scoped to query optimization, but this section documents SET CLUSTER SETTING commands that change behavior beyond a single query and can affect the whole deployment. In a guidance skill, this creates an authorization and blast-radius mismatch: a user seeking query tuning could be induced to make administrative changes with system-wide performance, availability, or data-governance consequences.
The documentation presents cluster-level settings as straightforward tuning options but does not warn that they may affect all users, workloads, or result semantics across the cluster. Missing safety context increases the chance of accidental misuse, especially in an agent setting where examples may be copied verbatim as recommendations.
Providing administrative cluster-setting actions is unjustified by the stated purpose of a query-review skill and may normalize privileged operational changes as routine tuning advice. An agent using this material could recommend or emit commands that alter global execution behavior, row limits, or ordering semantics without proper change control.
The file frames itself as relational-table-only guidance and includes caveats in some places, but also lists generic recommendations such as inverted indexes and multiple index forms without consistently tying them to confirmed KaiwuDB relational support. That creates mild intent/documentation divergence because the document presents advice as applicable guidance while only partially qualifying engine support.
The example WHERE u.region = 'Beijing'; embeds a specific locale/city value in natural language content. Because the document does not explain that this is merely one interchangeable example or that the skill is region-specific, it can be interpreted as privileging a specific locale without user opt-in.
ANALYZE table_name is an operational command that updates planner statistics, which goes beyond read-only EXPLAIN analysis and query rewriting guidance described in the manifest. While performance-related, it expands the skill from analysis into modifying database metadata/state.