ClawHub
Back to skill

Security audit

KWDB Time-Series Anomaly Detection

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real KWDB anomaly-detection skill, but it handles database credentials and includes a SQL runner that can execute and commit database-changing statements.

Review before installing. Use only a least-privileged read-only KWDB account, avoid production or admin credentials, inspect every SQL statement before execution, and remember that intermediate database results and reports may be written to /tmp.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding
The skill requires reading multiple reference files and writing results and reports to /tmp, yet it declares no permissions. This mismatch weakens least-privilege controls and can cause the platform or reviewer to underestimate the skill’s actual filesystem access, which matters because the workflow explicitly persists SQL outputs and generated reports.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The skill is presented as an anomaly-detection workflow, but its documented behavior delegates all SQL to a general-purpose execution script that can run arbitrary statements, including non-read operations, and can commit changes. That creates a dangerous trust gap: users may invoke a seemingly analytical skill that in practice has database client capabilities broad enough to alter or damage data, especially since it collects credentials and constructs SQL dynamically.

Static analysis

No suspicious patterns detected.