KWDB Time-Series Anomaly Detection

• Outcome: Review
• Latest audit: Jul 23, 2026 · 6:35 AM UTC
• Version: 1.2.0

Overview

The skill is for KWDB time-series anomaly detection, but it asks for database credentials and includes a broad SQL runner that can modify data if misused.

Review this skill before installing. Use only a read-only KWDB account, avoid privileged production credentials, verify every displayed SQL statement before allowing execution, and be aware that query results and reports may be written locally under /tmp. Delete retained reports when they contain sensitive telemetry or business data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill clearly instructs reading reference files and writing multiple outputs into /tmp, yet it declares no permissions. Undeclared file read/write capability weakens policy enforcement and user visibility, making it easier for the skill to access local guidance files and persist potentially sensitive query results without explicit authorization boundaries.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill is presented as anomaly detection, but its workflow accepts raw SQL text passed to a database execution script and does not technically constrain execution to read-only statements. That mismatch is dangerous because users may consent to analysis while the skill has the practical ability to run broader database operations, handle credentials, and write extracted data to files, increasing risk of data modification or exfiltration.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The workflow explicitly instructs operation in an 'insecure mode' and requires users to provide raw database credentials directly to the skill. This normalizes unsafe handling of secrets and can expose sensitive connection data through prompts, logs, process arguments, or downstream tooling without necessity tied to anomaly detection itself.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The script is a generic SQL executor that accepts arbitrary SQL from command-line input and runs it directly with database credentials, including DDL and write operations. In the context of an anomaly-detection skill, this exceeds the stated read/analysis purpose and enables destructive or unauthorized actions such as dropping tables, modifying data, or creating persistence objects if the skill or caller is abused.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The output path is fully user-controlled and the script writes query results to that path without restriction. In an agent-skill setting, this can be abused to overwrite files accessible to the process, potentially clobbering application state, planting data in sensitive locations, or aiding follow-on compromise.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The usage text explicitly frames the script as a general SQL client and even advertises CREATE TABLE operations, which is inconsistent with an anomaly-detection-only skill. This broadens expected use, normalizes dangerous database mutation behavior, and increases the likelihood that the capability will be invoked for unintended or harmful actions.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The description says to use the template when outputting detection results directly or in markdown/pdf format, which is broad and can cause the agent to apply this reporting behavior in many contexts without a clear user request. Overly broad activation can lead to unintended disclosure or formatting of sensitive anomaly-detection results, especially in workflows handling operational or telemetry data.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The workflow directs the skill to write SQL results and reports into /tmp without clearly warning the user about local artifact creation, retention, or possible exposure to other processes/users on the host. Since anomaly-detection outputs may contain sensitive operational or business data, silent persistence creates avoidable confidentiality and data-lifecycle risk.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The workflow repeatedly executes scripts with host, port, username, and password supplied as command-line arguments. On many systems, command-line arguments are visible to process listings, logs, shell history, or monitoring tools, which can leak database credentials and facilitate unauthorized access.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.