ClawHub
Back to skill

Security audit

postgres-tool

Security checks for vulnerabilities and agentic risk

Overview

This skill performs useful PostgreSQL tasks, but its database-change safety controls, credential handling, and installation guidance are risky enough to require review before installation.

Install only after review in a controlled environment. Use a dedicated least-privilege PostgreSQL role, remove the bundled postgres/postgres config, avoid sudo/admin installation, pin and verify dependencies, keep backups outside the skill package with restricted permissions, and do not rely on the advertised read-only, backup, restore, force, or dry-run protections for production data without code fixes.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (6)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/postgres_tool.py:143
Finding

Read-only query restriction bypass through data-modifying PostgreSQL CTEs

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/postgres_tool.py:458
Finding

Backup and confirmation safeguards are not bound to the SQL target table

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/postgres_tool.py:337
Finding

SQL injection through attacker-controlled restore metadata and CSV column names

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
config/db_config.json:1
Finding

Hardcoded plaintext PostgreSQL administrative credential

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/postgres_tool.py:237
Finding

Sensitive database records are written to unencrypted, access-unrestricted backup files

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
scripts/requirements.txt:5
Finding

Unpinned and unhashed third-party dependency installation

Content
View full analysis
=2.9.11 pandas>=2.0.0 openpyxl>=3.1.5 numpy>=1.24.0 python-dateutil>=2.8.0 tzdata>=2023.0 et-xmlfile>=1.1.0 ``` The documentation also recommends unconstrained online installation: ```bash pip install psycopg2-binary pandas openpyxl numpy python-dateutil tzdata et-xmlfile ``` The offline workflow downloads wheels without documented hash verification: ```bash pip download psycopg2-binary pandas openpyxl numpy python-dateutil tzdata et-xmlfile -d scripts/dependencies ``` ### Technical Analysis Every dependency uses a lower-bound constraint rather than an exact reviewed version. Future package releases can therefore be selected without any change to this project. No lock file, package hash, signature verification, or trusted artifact manifest is included. The offline transfer workflow also checks filenames and approximate file sizes rather than cryptographic integrity. This does not prove that any currently named package is malicious. It does, however, create a supply-chain path in which compromised, replaced, or unexpectedly incompatible future packages can enter the environment. ### Attack Path 1. A package source or transferred wheel is compromised, replaced, or serves an unsafe future release. 2. A user follows the documented installation command. 3. The `>=` constraints permit pip to select the affected release. 4. No expected hash is available to detect substitution. 5. Package installation or later import executes code from the compromised dependency with the installing user's privileges. ### Impact Assessment A compromised dependency can execute code in the Python environment, access database credentials available to the process, read or modify files, and interact with databases reachable by the tool. If users follow the documentation ...[truncated 136 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (38)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The stated purpose is database management, but the skill also includes environment inspection, dependency diagnostics, filesystem inspection, and package-management workflows. This mismatch can cause an agent or user to authorize the skill for database tasks while it performs unrelated local-system operations, expanding attack surface and creating opportunities for privilege misuse.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
89% confidence
Finding

The skill instructs use of rm -rf with a wildcard to delete dependency artifacts. Although the path is relatively specific, destructive shell patterns in agent-facing documentation are dangerous because path confusion, variable substitution, or working-directory mistakes can delete unintended files.

Content

Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.

md
cd .qoder/skills/postgres-tool

# 删除旧的依赖文件（如果有）
rm -rf scripts/dependencies/*.whl  # Linux/Mac
del /Q scripts\dependencies\*.whl  # Windows

# 下载与当前 Python 版本匹配的 wheel 文件

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
89% confidence
Finding

A second destructive deletion example repeats the same unsafe shell pattern, reinforcing risky operational behavior. In combination with shell-capable agents, such commands can be copied or adapted in ways that broaden deletion scope and damage local environments.

Content

Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.

bash
# 删除所有 wheel 文件并重新下载
cd .qoder/skills/postgres-tool
rm -rf scripts/dependencies/*.whl  # Linux/Mac
del /Q scripts\dependencies\*.whl  # Windows

# 重新下载

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill documents shell execution, filesystem reads/writes, and exporting data, but declares no explicit tool scope or permission boundaries. In an agent setting, this increases the chance the skill is invoked with overly broad capabilities, enabling unintended command execution, local file access, or data export beyond user expectations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The invocation guidance says to use this skill whenever users need PostgreSQL help, without clear boundaries on safe query classes, credential handling, or operation risk. Overly broad triggering can cause the agent to route common requests into a high-capability skill that can access databases, files, and shell commands unnecessarily.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill description begins in Chinese and presents the operational guidance in that language without indicating that another language can be used. This can violate language or locale policy where user choice or opt-in is required rather than assuming a fixed language.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Automatically searching for and loading db_config.json from multiple local paths encourages implicit credential discovery and connection behavior without prominent warnings about secrets handling. In an agent environment, this can lead to unintended use of locally stored database credentials and accidental access to sensitive databases.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
93% confidence
Finding

The documentation advises running installation with sudo, which elevates package installation and script execution to root privileges. If the dependency directory or install script is tampered with, this can turn a routine setup step into full system compromise.

Content

Scanner excerpt · SKILL.md (reported line 190)May include surrounding context.

解决方案：

bash
# Windows：以管理员身份运行 PowerShell
# Linux/Mac：使用 sudo
sudo ./install-dependencies.sh

# 或者安装到用户目录

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
93% confidence
Finding

The adjacent instruction still normalizes root-level execution for dependency installation, amplifying the risk from any compromised script or package artifact. In a skill that already uses shell and local files, combining setup steps with privilege escalation materially increases blast radius.

Content

Scanner excerpt · SKILL.md (reported line 191)May include surrounding context.

bash
# Windows：以管理员身份运行 PowerShell
# Linux/Mac：使用 sudo
sudo ./install-dependencies.sh

# 或者安装到用户目录
pip install --user --no-index --find-links=./scripts/dependencies -r scripts/requirements.txt

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The documentation claims only SELECT is allowed by default, yet elsewhere instructs direct execution of SQL and provides UPDATE/DELETE flows including a force flag. Conflicting guidance weakens safety assumptions and may lead an agent to execute destructive or exfiltrative SQL under the belief that the tool is read-only.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

All natural-language prompts and expected outputs are written in Chinese, and the file provides no indication that this is an optional locale or a region-specific skill. That can violate language/locale policy because it implicitly constrains usage to a specific language without offering choice or documenting justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file presents the skill examples and instructions entirely in Chinese, starting from the title and introductory text, with no indication that users may choose another language. Under the policy rules, forcing a specific language without user opt-in is a natural-language policy violation unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The guide tells users to create and edit db_config.json but provides no warning that this file will likely contain sensitive database credentials and connection details. In an internal deployment context, users may store plaintext secrets in the project directory, accidentally commit them, share them over removable media, or leave them with overly broad filesystem permissions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The examples run SQL directly against a live database and do not clearly emphasize read-only usage, non-production targets, or the risk of destructive statements. Because this skill is specifically for PostgreSQL management, operators may assume arbitrary SQL is acceptable and accidentally execute harmful queries against production data.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/OFFLINE_DEPLOYMENT_GUIDE.md (reported line 280)May include surrounding context.

Linux/Mac：

bash
sudo ./scripts/install-dependencies.sh

问题 5：依赖文件不完整

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The file’s instructional content is written entirely in Chinese, beginning with the title at L01 and continuing throughout the guide, with no indication that users may choose another language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
78% confidence
Finding

The documentation explicitly states that TRUNCATE TABLE is 'not in this skill's supported range,' which narrows the skill's documented scope beyond the manifest's broader claim of PostgreSQL database management. This creates intent-level inconsistency between the skill documentation and its stated purpose, because the guide frames a database operation as unsupported without any corresponding manifest limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module docstring and all user-facing strings are written exclusively in Chinese, which imposes a specific language on users. The file does not indicate that Chinese is optional, configurable, or required for a region-specific purpose, so this is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest describes a PostgreSQL management tool for connecting to databases, querying data, inspecting schemas, exporting results, and safely performing UPDATE/DELETE operations. This file instead implements a general environment and package-installation diagnostic utility, including pip checks and installation guidance, which is not part of the stated database-management behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

A PostgreSQL management skill would be expected to interact with databases and local exports, but spawning subprocesses to run pip is a separate package-management capability. The manifest does not mention environment administration or dependency tooling, so this capability is broader than the declared purpose.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/diagnose_deps.py (reported line 92)May include surrounding context.

python
import subprocess
    try:
        result = subprocess.run([sys.executable, "-m", "pip", "--version"], 
                              capture_output=True, text=True, timeout=5)
        if result.returncode == 0:
            print(f"✓ Pip 版本：{result.stdout.strip()}")

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/diagnose_deps.py (reported line 113)May include surrounding context.

python
import subprocess
    try:
        result = subprocess.run([sys.executable, "-m", "pip", "list"], 
                              capture_output=True, text=True, timeout=10)
        if result.returncode == 0:
            installed_lines = result.stdout.strip().split('\n')[2:]  # 跳过表头

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The module description and all user-facing prompts/messages are in Chinese, which imposes a specific language on users. The file does not provide any mechanism to select another language or document that the skill is intentionally region-specific.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest and module docstring describe querying, schema inspection, export, safe UPDATE/DELETE, and recovery, but this recovery implementation is itself a broad write capability: it can INSERT rows, UPSERT with ON CONFLICT, and DELETE-then-INSERT in replace mode. That goes beyond the specifically described modification scope of safe UPDATE/DELETE operations and materially expands write behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

This JSON manifest-like file contains only Chinese prompt examples for invoking the skill, but it does not clarify whether the skill is intended to activate only for Chinese requests or whether other languages are supported. In a manifest/evals context, that creates ambiguity about trigger scope and may cause unintended assumptions about when the skill should apply.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.