KWDB Time-Series Anomaly Detection

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:22 AM UTC
• Version: 1.2.1

Overview

This KWDB anomaly-detection skill is purpose-aligned, but it needs review because it handles database credentials and runs broad SQL through unsafe local scripts.

Install only if you are comfortable giving this skill access to a KWDB account and local report files. Use a dedicated read-only database user, avoid sensitive production data, treat /tmp reports as sensitive, and prefer a revised version that removes command-line passwords, enforces read-only SQL, uses authenticated TLS with timeouts, parameterizes queries, and safely escapes generated HTML.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/kwdb_sql_execute.py:69

Finding

Database Password Exposed Through Process Arguments

Content

View full analysis

6 else None execute_sql_once(host, port, user, password, sql, output_file) ``` The workflow explicitly requires invocation in this form: ```bash python scripts/kwdb_sql_execute.py "SELECT 1" ``` ### Technical Analysis The database password is supplied as a positional command-line argument and retrieved from `sys.argv[4]`. Command-line arguments can be exposed through operating-system process inspection interfaces, process-monitoring software, audit systems, diagnostic tooling, and command histories. The mandatory consent prompt acknowledges that database configuration is sensitive, but consent does not mitigate the technical exposure. Passing a secret through `argv` is not necessary for the declared anomaly-detection functionality because safer credential channels are available. ### Attack Path 1. A user supplies valid KWDB connection credentials to the Skill. 2. The Skill launches `kwdb_sql_execute.py` using the documented command format. 3. The plaintext password is included in the child process's argument vector. 4. While the process is running, another local user or monitoring component reads the process command line or captures process-execution telemetry. 5. The observer recovers the database username, endpoint, and password. 6. The stolen credentials are used to connect directly to KWDB with all privileges granted to that account. ## ...[truncated 346 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/kwdb_connection.py:5

Finding

Database Connection Does Not Enforce Authenticated TLS or a Connection Timeout

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: references/workflow.md:74

Finding

Unsafe Dynamic SQL Construction and Unrestricted SQL Execution

Content

View full analysis

FROM ` via `kwdb_sql_execute.py` (no output file). Parse stdout to extract distinct values. 2. If the distinct list is empty, stop permanently. 3. For each primary tag value: - Append `AND = ''` to the `WHERE` clause (or add `WHERE = ''` if no `WHERE` exists). - Execute steps 5–13 for this value. ``` ```python def execute_sql_once(host, port, user, password, sql, output_file=None): conn = None cursor = None try: conn = create_kwdb_connection(host, port, user, password) cursor = conn.cursor() cursor.execute(sql) ``` Metadata instructions also interpolate identifiers directly: ```sql SHOW TABLES FROM dbname; SHOW CREATE TABLE dbname.tbname; DESCRIBE dbname.tbname; SHOW COLUMNS FROM dbname.tbname; ``` ### Technical Analysis Primary-tag values are read from the database and then inserted into a quoted SQL literal by textual concatenation. Replacing `/` in a filename does not make the value safe for SQL. A value containing a quote, comment token, or statement delimiter can terminate the intended literal and alter the query. Database, table, column, and primary-tag identifiers are also inserted directly without safe identifier composition. Metadata existence checks reduce accidental errors but are not a substitute for contextual SQL quoting. The executor sends the supplied SQL directly to `cursor.execute(sql)`. It does not parse or enforce a single read-only `SELECT`, reject multiple statements, or start a read-only transaction. The documentation forbids database writes, but that prohibi ...[truncated 1326 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/html-report-gen.py:171

Finding

Stored Cross-Site Scripting in Generated HTML Reports

Content

View full analysis

1 if use_tabs: tab_buttons = [] tab_panels = [] for i, tag in enumerate(tags): is_active = i == 0 tv = _e(tag["tag_value"]) active_cls = " active" if is_active else "" tab_buttons.append( f'

{tv}

' ) ``` ```python f" Anomaly Detection Report - {full_name}\n" ``` ```python f"

Detection Report for {full_name}

\n" f"

{display_name}

\n" f"

{detection_time}

\n" f"

{span_display}

\n" ``` ### Technical Analysis Several fields from report JSON are inserted into HTML without escaping, including the database name, table name, detection time, and time-span values. These fields can therefore terminate their intended elements and insert arbitrary HTML or script-capable markup. The tag value is processed with `h ...[truncated 1632 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (23)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The workflow tells the agent to execute SQL supplied/generated from user intent via a general-purpose executor, while only policy text—not technical enforcement—attempts to forbid destructive operations. In a skill context for anomaly detection, this is especially risky because broad activation could route ordinary analytics requests into a capability that can perform arbitrary database actions and persist outputs to files.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The workflow tells the agent to execute SQL supplied/generated from user intent via a general-purpose executor, while only policy text—not technical enforcement—attempts to forbid destructive operations. In a skill context for anomaly detection, this is especially risky because broad activation could route ordinary analytics requests into a capability that can perform arbitrary database actions and persist outputs to files.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The workflow tells the agent to execute SQL supplied/generated from user intent via a general-purpose executor, while only policy text—not technical enforcement—attempts to forbid destructive operations. In a skill context for anomaly detection, this is especially risky because broad activation could route ordinary analytics requests into a capability that can perform arbitrary database actions and persist outputs to files.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The workflow explicitly tells the agent to operate in an 'insecure mode' and frames access to sensitive database configuration as something the user should consent to expose. This normalizes unsafe handling of secrets and may pressure users into disclosing credentials or configuration data that the skill should never request in plaintext.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script executes any SQL string provided on the command line with no restriction to read-only or anomaly-detection queries. In the context of a skill advertised for anomaly detection, this unnecessarily expands capability to destructive or administrative actions such as DROP, ALTER, UPDATE, or privilege changes, increasing the risk of misuse, prompt-driven abuse, or operator error.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill requires reading reference files and writing results under /tmp, yet it declares no explicit tool or permission scope. That creates an authorization gap where the runtime may grant broader file access than intended, making it harder to enforce least privilege and increasing the blast radius if the skill is abused or misrouted.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The activation criteria are broad enough to catch generic inspection, validation, and unusual-value requests, not just anomaly detection. This increases accidental invocation of a powerful database-access skill, expanding exposure to credential collection, arbitrary querying, and unintended data handling in contexts where the user did not request such access.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Step 8 requires informing the user with a fixed Chinese sentence when the dataset is too large. This forces a specific language in a user-facing interaction, and the file does not provide opt-in, fallback language behavior, or a documented region-specific justification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The description says 'When determining whether the specific column is anomaly with rules, follow this document,' which is broad and unclear about exactly when the skill should be invoked. It does not provide explicit trigger phrases, scope boundaries, or exclusion cases, increasing the risk of unintended activation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest description says 'when querying the metadata of database/table/column, follow this document,' which is a broad activation condition without clear scope boundaries, explicit trigger phrases, or exclusion cases. Because this is a markdown/manifest-style header, the wording could match many ordinary database-help requests and may cause unintended invocation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The instructional content is written entirely in Chinese, including section headers, explanations, and examples, with no indication that the skill is region-specific or that users may choose another language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The workflow requires users to provide raw database host, port, username, and password directly to the skill and then reuses those credentials across multiple script invocations. For an anomaly-detection skill, this is broader access than necessary and increases the chance of credential exposure through prompts, logs, process arguments, or downstream tooling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The workflow repeatedly writes SQL results, detection outputs, JSON, Markdown, and HTML reports into /tmp without warning about local persistence, access scope, or residual sensitive data. Temporary directories are often readable by other local processes or preserved longer than expected, so database contents and anomaly results may leak even if cleanup is attempted later.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file contains multiple hard-coded Chinese strings for inferred frequency labels and status/error messages, such as at L021-L037 and L043-L050. Because the script presents user-facing output only in Chinese and provides no opt-in or locale selection, it violates the language-choice policy for natural-language behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The user-visible natural-language content in docstrings and the raised exception message is exclusively in Chinese, which can impose a language choice on users without opt-in. The policy allows locale constraints only when justified or when users are given a choice, neither of which is indicated in this file.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The inline usage/help text describes the program as "kwdb_sql_client.py" and includes an example creating a table, which signals a general-purpose SQL client rather than an anomaly-detection tool. This active documentation conflicts with the manifest's claim that the skill automates anomaly detection for time-series data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The user-facing usage strings are entirely in Chinese, which imposes a specific language on users. The file does not indicate that the skill is region-specific or provide any opt-in or alternative locale, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The output_file parameter allows writing query results to an arbitrary filesystem path without validation or confinement. While the content written is JSON data, arbitrary file write can still overwrite application files, user files, or sensitive paths accessible to the process, which is not justified by the skill's anomaly-detection scope.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Line L003 says 'When output the detection result with html format' without defining a specific command, trigger phrase, or activation boundary. This is ambiguous enough to overlap with many ordinary requests to format results as HTML, increasing the chance of unintended invocation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The workflow specifies a fixed Chinese message for oversized datasets, which imposes a specific language on the interaction without offering user choice. This is a natural-language policy issue because the file otherwise uses English and does not document a region-specific reason for forcing Chinese output.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The manifest describes automating end-to-end anomaly detection for KWDB time-series data, but the workflow also includes generating Markdown and HTML report files and preserving a final report artifact. Reporting may support the task, but persistent file generation goes beyond the narrowly described detection behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The generated HTML sets the document language to zh-CN, which forces a specific locale for all reports. In this code file there is no user opt-in, configuration option, or documented region-specific justification for that locale constraint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This code performs a network connection using supplied host, user, and password values, which is a safety-relevant operation under the code-file warning criteria. Although the function docstring describes connection creation, it does not warn that credentials and connection metadata will be sent to a remote database, and there is no user-facing log, prompt, or other disclosure in this file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.