Security audit

KWDB Schema Design

Security checks for vulnerabilities and agentic risk

Overview

This is a markdown-only KWDB schema design skill with some high-impact SQL examples users should review before running.

Install only if you want KWDB-specific schema/DDL help. Before executing generated SQL, confirm the target database engine and environment, and manually review destructive or administrative statements such as DROP, CASCADE, RETENTIONS, GRANT, REVOKE, and CREATE/DROP USER.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (28)

Self-Modification

High

Category: Rogue Agent
Confidence: 70% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · references/table-ddl-ref.md (reported line 161)May include surrounding context.
md
| `TAGS (ts TIMESTAMPTZ, ...)` | Tags only: INT/FLOAT/CHAR/VARCHAR | Tags 不支持 TIMESTAMPTZ | | No RETENTIONS on high-volume table | `RETENTIONS 180d` | 无 retention 数据无限增长 | | `price DECIMAL(18,4)` in TS table | `price FLOAT8` | TS 表不支持 DECIMAL 数据列 | | `CHECK (status IN (...))` in TS table | Remove CHECK, validate in app | TS 表不支持 CHECK 约束 | | `id INT4 DEFAULT unique_rowid()` | `id INT8 DEFAULT unique_rowid()` | unique_rowid() 返回 INT8，与 INT4 类型不匹配 | ### Error vs Correct Examples

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill metadata says user/permission management is out of scope, but the reference architecture explicitly includes privilege-ref.md under Tier 4. That inconsistency can cause the agent to perform privileged DDL or security-adjacent guidance outside the declared boundary, increasing the chance of unsafe or unintended administrative actions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger conditions include generic phrases like 'create table', 'primary key', and 'schema design' without requiring KWDB context. This can cause the skill to hijack ordinary database requests for other engines, producing incorrect DDL or bypassing more appropriate skills, which is a form of unsafe over-activation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: Time-series terms such as 'sensor data', 'IoT', 'metrics', and 'logs' are common across many platforms and are not KWDB-specific. Over-broad matching can activate the skill in unrelated contexts and lead to dialect-confused schema advice, especially for retention, tags, or partitioning features that differ significantly across systems.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: Financial/trading keywords like HFT, order book, tick data, VWAP, and stock are domain terms rather than database-skill terms. Their inclusion can spuriously trigger the skill during general finance discussions, causing irrelevant or misleading schema-generation behavior in non-KWDB contexts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown file includes example prompts for dropping a table and dropping an index, which can affect user data or system integrity. Under the markdown-specific SQP-2 criteria, the description should warn users about destructive or irreversible behavior, but no warning appears near the DROP section or elsewhere in the file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This markdown file contains natural-language content that switches to Chinese in SQL comments, which can force a specific language on users without opt-in. The surrounding examples are otherwise in English, and there is no indication that the skill is region-specific or that users may choose their preferred language.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Lines L111-L112 explicitly state that KWDB auto-creates an index for foreign keys and warns not to create a duplicate index. However, later content shows CREATE INDEX idx_orders_customer ON orders (customer_id); at L164 and repeatedly advises Index FK columns / FK columns indexed at L197 and L237, which contradicts the earlier guidance and could cause duplicate-index recommendations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The reference includes DROP DATABASE and DROP SCHEMA ... CASCADE examples without any nearby warning that these operations are irreversible and can delete large amounts of data. In a schema-design skill, users may copy commands directly, so omission of safety guidance increases the chance of accidental destructive actions, especially for production or multi-tenant environments.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This markdown file is primarily written in English, but lines L169-L190 introduce substantial Chinese-only instructional content and table entries. That forces a specific language for part of the skill content without user opt-in or justification, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This markdown file contains instructional content in Chinese, which effectively imposes a language requirement on readers for part of the core decision guidance. The policy allows locale constraints only when clearly documented and justified, or when users are given a choice; neither is present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Multiple rule explanations and error-handling notes are written partly in Chinese, including normative guidance users must understand to apply the skill correctly. Because the file does not state that the skill is region-specific or offer a language choice, this is a natural-language locale policy concern.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file materially expands a schema-design skill into user, role, and privilege administration by embedding CREATE USER, DROP USER, GRANT, and REVOKE commands. In an agent setting, this increases the chance the skill will answer out-of-scope security-administration requests and may help users perform privilege changes without appropriate separation of duties or review.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest says this skill is for designing KWDB schemas and generating DDL for tables, indexes, views, constraints, partitioning, retention, and tags, and explicitly says it is not for DML queries, deployment, backup, or performance tuning. This reference file instead documents stored procedures and functions, including procedural business logic and transaction control, which are not part of the declared schema-design scope and go beyond the listed covered objects.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The file teaches procedure usage with COMMIT and ROLLBACK and explicitly highlights transaction control for procedures. A schema-design skill focused on DDL generation does not need to expose transactional stored procedure logic, and the manifest does not declare stored programming or transaction-management as part of scope.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The reference states that expired data is 'silently dropped' but does not present a prominent warning that retention settings cause irreversible automatic deletion. In a schema-design skill, users may directly apply these examples to production DDL, so understated documentation can lead to accidental destructive data loss and compliance issues.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The manifest describes a skill for schema design and DDL around tables, indexes, views, constraints, partitioning, retention, and tags, and explicitly says it is not for DML queries. This reference file documents database triggers and trigger functions that execute on INSERT/UPDATE/DELETE events, introducing operational behavior beyond the manifest’s stated KWDB schema-design scope.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file is predominantly written in English, but the 'Mistake Summary' impact descriptions switch to Chinese on lines L128-L135. This imposes a language change without user opt-in or documented locale justification, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Lines L022-L028 switch to Chinese for core usage limitations and workaround guidance, while the rest of the document is in English. This imposes a language constraint on users without offering a language choice or documenting that the skill is intended for Chinese-speaking users only.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 69% confidence
Finding: The manifest limits the skill to schema design and says it is not for deployment. Including references/database-ref.md for database and schema operations expands the documented behavior beyond table/index/view design into higher-level database administration tasks that may be interpreted as deployment-related.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This reference is primarily written in English, but lines L020-L024 switch to Chinese for an important section about time-series constraint limitations and workarounds. That imposes a language requirement on readers without opt-in or justification, which matches the locale/language policy concern for natural-language content.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This reference is primarily written in English, but line L071 introduces a substantive instruction in Chinese without offering a language choice or documenting a locale-specific requirement. That can violate language/locale policy because it forces a specific language for part of the guidance without user opt-in.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The document says privilege content is low-frequency and should only be read on explicit request, yet it still includes detailed administrative commands in the same skill reference set. That mismatch weakens scope boundaries and can cause retrieval systems or agents to surface sensitive admin guidance even when the user asked only for schema design help.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The role descriptions at L79-L80 include Chinese terms ("权分立") embedded in otherwise English documentation, which imposes a locale/language choice without explanation or user opt-in. This matches the policy category for language/locale violations because the file does not offer alternatives or document a justified region-specific constraint.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.