Security audit

KWDB Performance Review

Security checks for vulnerabilities and agentic risk

Overview

This KWDB performance skill is mostly advisory, but it includes admin-level cluster setting and DDL examples despite also saying configuration and schema changes are out of scope.

Install only if you want a KWDB performance helper that may also suggest administrator-level configuration and schema changes. Treat any SET CLUSTER SETTING, CREATE INDEX, or DROP INDEX output as a proposal for a qualified database operator to review and test outside production first, not as a command for an agent to run automatically.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (12)

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The skill metadata and trigger policy say deployment/configuration work is out of scope, but the body later provides cluster-setting guidance and configuration tuning workflows. This scope contradiction can cause the agent to enter higher-risk operational guidance paths unexpectedly, including advice that changes cluster behavior and resource usage.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The file says deployment/configuration questions should not trigger, yet the activation logic later enables 'config optimization' and 'parameter tuning'. Conflicting routing criteria can make the skill activate for requests it claims to exclude, increasing the chance of unsafe or unintended operational recommendations.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The template materially expands the skill from SQL query performance review into cluster configuration tuning, including memory, compression, compaction, and vacuum settings. That scope drift can cause an agent invoked for safe read-only query advice to instead generate operationally sensitive recommendations that may degrade availability, increase resource usage, or alter data lifecycle behavior if applied.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The template explicitly instructs generation of cluster-level SQL such as SET CLUSTER SETTING, enabling an agent positioned as a query-performance reviewer to recommend privileged, environment-wide changes. If an operator copies these commands, the impact extends beyond a single query to the whole cluster, potentially causing performance regressions, memory pressure, compaction disruption, or unintended data-retention effects.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The skill is described as a query performance reviewer, but this file provides direct cluster-wide administrative change commands. That scope expansion is dangerous because an agent or user relying on the skill may apply live configuration changes with broad operational effects, including reduced throughput, increased memory pressure, or altered storage behavior beyond a single query-review task.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The repeated inclusion of cluster-setting change recipes shows the skill materially exceeds its narrow query-optimization remit. In agent settings, this can normalize privileged operational changes as routine advice, increasing the chance of unsafe changes being suggested or executed in production without proper review.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: Cluster-wide tuning capability is not justified by a skill positioned as a query performance reviewer, because it implicitly grants or encourages operational authority far beyond reviewing SQL. This is more dangerous in context because the settings affect global compaction and storage behavior, so misuse can impact availability, resource consumption, and performance across the entire cluster.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The file provides detailed cluster parameter tuning guidance even though the skill metadata says it is for SQL query performance review and explicitly not for deployment or broader configuration changes. This scope expansion is dangerous because it can steer an agent to recommend or facilitate high-impact operational changes that affect memory, disk usage, compaction, caching, and write durability/performance at the cluster level rather than limiting itself to query analysis.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: This section includes `SET CLUSTER SETTING` commands even though the skill is scoped to query optimization and explicitly not for deployment or broader administration. In an agent setting, presenting cluster-level tuning commands can cause the agent to recommend or execute environment-wide configuration changes with operational and security consequences beyond a single query.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger keywords include broad phrases like 'performance', 'slow query', and 'explain', which are common in many database and application contexts. Overbroad triggers raise the risk of accidental activation outside the intended KWDB/SQL scope, leading to irrelevant or unsafe advice in the wrong environment.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The activation examples include ambiguous phrases such as 'config optimization', 'parameter tuning', and generic performance complaints without always requiring KWDB or SQL context. This increases the chance the skill is selected for unrelated systems or for operational tuning requests outside its safe bounds.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The examples present live `SET CLUSTER SETTING` commands without an explicit warning that they immediately modify runtime behavior for the whole cluster. Even if the settings are legitimate, omission of cautions increases the risk that users or agents will treat them as low-risk copy-paste guidance and cause unintended production impact.

Static analysis

No suspicious patterns detected.