T08 · Insecure Dependencies
Warning
- Location
SKILL.md:193- Finding
Unpinned Global Dependency Installation Creates a Supply-Chain Execution Risk
- Content
View full analysis
- Remediation
View remediation
Security audit
db-toolkit
Security checks for vulnerabilities and agentic risk
Overview
This database skill has useful database helpers, but it automatically searches for credentials and relies on risky plaintext and global-install workflows.
Install only if you are comfortable with the agent reading project configuration files for database credentials and connecting to real databases. Prefer supplying a limited, non-production, read-only credential yourself; avoid passing real passwords on the command line; and use a project-local dependency install instead of the documented global npm install.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:77- Finding
Automatic Discovery Reads Credential-Bearing Project Configuration Without Explicit Per-Source Approval
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:239- Finding
Database Passwords Are Passed Through Process Command-Line Arguments
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/test-connection.ts:22- Finding
PostgreSQL TLS Requirement Is Discarded During Connection URL Parsing
- Content
View full analysis
= { 'mysql': 'mysql', 'mysql2': 'mysql', 'postgresql': 'postgresql', 'postgres': 'postgresql', 'pg': 'postgresql', }; const dbType = dbTypeMap[protocol]; if (!dbType) { throw new Error(`Unsupported database protocol: ${protocol}`); } return { dbType, host: parsed.hostname, port: parsed.port ? parseInt(parsed.port) : undefined, user: parsed.username, password: parsed.password, database: parsed.pathname.slice(1), }; } ``` The resulting PostgreSQL client configuration does not contain an `ssl` option: ```typescript const { Client } = require('pg'); const client = new Client({ host: config.host, port: config.port || 5432, user: config.user, password: config.password, database: config.database, connectionTimeoutMillis: 10000, }); ``` ### Technical Analysis The URL parser extracts the host, port, user, password, and database but ignores ...[truncated 1427 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/describe-table.ts:261- Finding
SQLite Schema Inspection Interpolates Untrusted Identifiers into PRAGMA Statements
- Content
View full analysis
{ const Database = require('better-sqlite3'); const db = new Database(config.database!); try { const tableInfo = db.prepare(`PRAGMA table_info(${tableName})`).all() as any[]; const columns: ColumnInfo[] = tableInfo.map(r => ({ name: r.name, type: r.type, nullable: !r.notnull, defaultValue: r.dflt_value, })); const primaryKey = tableInfo .filter(r => r.pk > 0) .sort((a, b) => a.pk - b.pk) .map(r => r.name); const indexList = db.prepare(`PRAGMA index_list(${tableName})`).all() as any[]; const indexes: { name: string; columns: string[]; unique: boolean }[] = []; for (const idx of indexList) { if (idx.origin === 'pk') continue; const indexInfo = db.prepare(`PRAGMA index_info(${idx.name})`).all() as any[]; indexes.push({ name: idx.name, columns: indexInfo.map(i => i.name), unique: idx.unique === 1, }); } const fkList = db.prepare(`PRAGMA foreign_key_list(${tableName})`).all() as any[]; const fkMap = new Map(); ``` ### Technical Analysis `tableName` originates from the command-line `--table` option and is directly interpolated into four SQL statements. Index names retrieved from the database are also interpolated into `PRAGMA index_info(...)`. Neither source is validated or safely quoted as an SQLite identifier. Prepared-statement restrictions may prevent execution of multiple stacked statements, which limits the severity. Nevertheless, crafted names can change SQL parsing, cause unexpected PRAGMA behavior, or repeatedly terminate ...[truncated 1048 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (30)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The description presents a broad database operations skill covering connection testing, schema exploration, arbitrary SQL execution, and DDL/DML changes across MySQL/PostgreSQL/SQLite. The actual code only implements one narrow function: describe a specified table's schema. It does connect to the declared database types, but only to fetch metadata for a single table. There is no functionality for executing user-provided SQL, inserting/updating/deleting data, creating or altering schema, or listing tables. This is a material scope mismatch: the declared primary purpose is a general database operations tool, while the code chunk is a table-schema inspection script.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
声明描述的是一个较完整的多数据库操作工具，涵盖连接、Schema 浏览、DDL/DML 和多类数据库管理触发场景。但提供的代码片段只包含 test-connection.ts，其核心功能是测试数据库连接并读取版本号，不支持表结构查询、列出表、执行用户 SQL、插入/更新/删除数据或修改 Schema。虽然“测试数据库连接”属于声明触发场景之一，但代码实际主功能明显比声明范围窄，无法代表所宣称的数据库操作工具整体能力，因此存在描述与实际行为不一致。
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - ✅ 使用 `scripts/describe-table.ts` 查询实际数据库中的表结构
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - ✅ 使用 `scripts/describe-table.ts` 查询实际数据库中的表结构
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly instructs the agent to automatically search project files such as .env, application.yml, settings.py, and ORM configs for database connection details before asking the user. This is dangerous because those files commonly contain secrets, and the agent is being directed to discover and use credentials without explicit user consent, expanding access to sensitive data and enabling lateral movement into real databases.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
The guidance specifically targets .env and .env.production files, which are high-probability secret stores for production credentials. In the context of a database skill, instructing an agent to inspect these files materially increases the chance of unauthorized credential access and use against live systems.
- Content
text 1. 环境变量文件 - .env, .env.local, .env.development, .env.production 2. 应用配置文件（常见框架） - **Spring Boot**: application.yml, application.yaml, application.properties
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill goes beyond locating config files and instructs extraction, placeholder resolution, and normalization of sensitive values including database passwords and full connection URLs. That creates a clear credential-handling vulnerability: it operationalizes secret harvesting and makes it easier for the agent to surface, transform, and potentially leak usable credentials.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 99% confidence
- Finding
The example includes a literal DATABASE_URL with embedded username and password, normalizing the practice of extracting and handling plaintext credentials. In a skill designed to connect to databases, this materially increases the risk of credential disclosure, misuse, and accidental propagation into outputs or follow-on commands.
- Content
text ```env # .env DATABASE_URL=mysql://root:secret@localhost:3306/mydb
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The natural-language description and operational instructions are presented entirely in Chinese, with no indication that the user may choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the language/locale policy, a forced language without opt-in can be a policy issue unless explicitly justified.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The activation condition "任何涉及数据库 DDL/DML 操作的请求" is extremely broad and does not define clear boundaries for when the skill should or should not activate. Because it lacks exclusions or a constrained trigger list, it could match a wide range of routine conversation about databases and cause unintended invocation.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Lines L021-L023 present the skill as non-persistent and not writing files, creating an expectation of minimal local side effects for handling connection information. However, L194-L215 instructs global package installation and modification of the shell environment via NODE_PATH, which are persistent host-level changes and contradict the '不写入任何文件/不持久化存储' framing as written.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The examples explicitly place database passwords on the command line and normalize this as standard usage. Command-line secrets can be exposed through shell history, process listings, audit logs, CI job output, and shared terminal recordings, which creates a real credential leakage risk for a database-access skill.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file includes
DROP TABLE IF EXISTS users;andTRUNCATE TABLE users;, which can delete data or schema state, but the surrounding documentation provides no warning about irreversibility, data loss, or the need to verify the target environment first. Under the markdown-specific warning criteria, examples that affect user data or system integrity should be accompanied by clear cautionary language.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The file includes destructive SQL operations such as DELETE and TRUNCATE with no accompanying warning about irreversible data loss, backup requirements, or safe execution practices. In a skill explicitly triggered for live DDL/DML database operations, these examples can be copied directly into production-like contexts and increase the chance of accidental mass deletion.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation includes example commands that place the database password directly on the command line and inside a connection URL. Command-line arguments can be exposed through shell history, process listings, logs, and audit tooling, which can leak credentials to other local users or monitoring systems. In a database-operation skill, this is more dangerous because users are likely to copy-paste the examples verbatim with real production credentials.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documentation includes destructive SQL examples such as DROP TABLE ... CASCADE and TRUNCATE without adjacent warnings about irreversible data loss or guidance to verify environment/backup status first. In a database-operation skill, users are likely to copy commands directly into real systems, which increases the chance of accidental production data deletion.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file documents data-modifying and data-deleting SQL operations, including broad updates and deletes such as updating inactive users and deleting multiple rows. Under the markdown-file criteria, the description should warn that these commands can alter or remove user data if run against a real database, but no such warning is present near the examples.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documentation includes destructive SQLite DELETE examples, including deleting all rows and resetting sqlite_sequence, without any warning about irreversible data loss, backups, or transaction safeguards. In a skill explicitly designed to help users execute DDL/DML against live databases, such examples can be copied directly into production contexts and cause accidental mass deletion.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The usage examples explicitly encourage passing the database password on the command line, which can leak secrets through shell history, process listings, audit logs, and orchestration telemetry. In a database administration skill, exposing credentials is especially risky because those credentials may grant broad access to production data and schema metadata.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The MySQL connection code initiates a network connection using supplied host, user, and password values, and similar behavior exists for PostgreSQL. While connecting to a database is part of the script's purpose, there is no explicit warning in code comments or CLI help that credentials and schema queries will be sent to a remote database server.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This code opens whatever path is supplied in config.database for SQLite, which performs local filesystem access. Although the script header explains usage, it does not warn users that providing a SQLite database path will cause the tool to open and inspect a local file.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file's natural-language description, usage notes, and output explanation are presented exclusively in Chinese. Under the policy, forcing a specific language without offering a user choice or documenting a justified locale constraint is a natural-language policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This code opens outbound MySQL connections using host, user, password, and database parameters, which sends potentially sensitive connection data to a remote system. Although network access is central to the script's purpose, the file does not include any user-facing warning or disclosure that credentials and connection metadata will be transmitted to the specified server.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The PostgreSQL client is configured with host, user, password, and database values and then connects to a remote endpoint. The script lacks any comment or user-facing warning that running it will contact an external server and use the provided credentials during that connection attempt.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
SQP-3 applies to all file types and covers language or locale policy violations. This file presents all instructions in Chinese only, with no indication that the skill is region-specific or that users may choose another language, which can amount to an undocumented forced language constraint.
- Content