Security audit

sql-reports

Security checks for vulnerabilities and agentic risk

Overview

This SQL reporting skill has a coherent business purpose, but it exposes database credentials and can return broad internal delivery data on unsupported commands.

Only install this for an authorized internal environment after rotating the exposed database password, moving credentials to a secure secret source, limiting the database account to read-only least privilege, replacing generic triggers with specific ones, and changing unknown commands to fail closed instead of exporting detailed records.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: query.py:4
Finding: Hard-Coded SQL Server Credentials in Source Code
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: query.py:99
Finding: Unknown Commands Trigger an Unrestricted Delivery Data Export
Content: View full analysis
1: arg = sys.argv[1].lower() if "day" in arg: print(summary_by_day()) elif "month" in arg: print(summary_by_month()) elif "year" in arg: print(summary_by_year()) else: print(query_items_by_date()) ``` The fallback invokes `query_items_by_date()` without either date argument. Its unfiltered branch queries and returns all matching delivery-item records: ```python else: query = """ SELECT h.DeliveryNo, h.ScheduledDeliveryDate, i.ItemNo, i.ItemCode, i.ItemDescription, i.DeliveryQty, i.Unit, i.NetWeight, i.Batch FROM DeliveryHeaders h INNER JOIN DeliveryItems i ON h.DeliveryNo = i.DeliveryNo ORDER BY h.ScheduledDeliveryDate """ cursor.execute(query) ``` ### Technical Analysis Command selection uses substring checks rather than an explicit allowlist of exact command names. Every unrecognized input enters the `else` branch and calls `query_items_by_date()` without filtering parameters. Because the function's no-argument branch omits a `WHERE` clause, it prints the complete joined delivery-item dataset available to the database account. This is a fail-open behavior: invalid or unsupported requests receive more detailed information instead of being rejected. The documentation advertises commands such as `quarterly_report` that are not implemented. Invoking that documented command does not contain `day`, `month`, or `year`, so it reaches the unrestricted export path. ### Attack Path 1. A user or attacker invokes the skill with any unmatched input, such as `quarterly_report` or an arbitrary string. 2. `skill.json` passes that input as the first comm ...[truncated 1032 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:19
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill documentation describes connectivity to an internal SQL Server and access to business delivery data, but it does not prominently warn users that using the skill will reach into an internal network resource and query potentially sensitive operational data. This can lead to uninformed use, accidental data exposure, or execution in environments where internal resource access should be explicitly disclosed and approved.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The code hardcodes a full SQL Server connection string including username and password directly in the source. Embedded credentials are dangerous because they can be recovered from source control, logs, backups, or redistributed skill packages, enabling unauthorized database access and lateral movement if the account is reused or overprivileged.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger phrase "do report" is overly generic and can easily match ordinary user language unrelated to this SQL reporting skill. That increases the chance of accidental invocation, which is risky here because the skill executes a Python script that likely queries a SQL Server backend and may expose internal business data or perform unintended operations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The functions connect to SQL Server and fetch delivery data, then print or return the results, but the file provides no user-facing notice, confirmation, or explanatory comment about this network/database access. For a code file, external data access that may transmit user or system data should include some form of visible disclosure unless clearly documented elsewhere, which is not present here.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.