ClawHub

Sql Audit

Security checks across malware telemetry and agentic risk

Overview

This skill is meant to execute database queries, but it does not enforce its advertised SQL safety blocks and has broad credential and external-service handling that users should review carefully.

Install only in a controlled environment with read-only, least-privilege database credentials and approved network access. Treat query results and fallback prompts as potentially sensitive, disable or review Gemini fallback before production use, and patch or verify SQL safety checks before allowing live database execution.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill declares no permissions while its documented behavior includes environment access, network connectivity, and writing workflow files. This is dangerous because it hides the real execution surface from reviewers and users, making credential use, data exfiltration, or unintended persistence easier to miss during approval.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding
The skill is presented as a SQL audit/execution tool, but the documented behavior expands into external LLM calls, credential consumption, workflow orchestration, and automatic query regeneration. That mismatch is security-relevant because operators may approve it for limited SQL checking while it can also transmit prompts/metadata externally and perform broader automated actions than expected.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The skill reads a local .env file and then forwards DB and external LLM credentials/configuration into the Python subprocess and skill runtime. That broadens the trust boundary beyond simple SQL auditing/execution and can expose secrets to code paths or downstream services not clearly required by the user request.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The markdown explicitly states that SQL will be executed against a real StarRocks/Doris system and query results returned, but it provides no warning about sensitive data access, privacy implications, or production-database risk. In this context, real execution materially increases danger because even read-only queries can expose confidential business data or large unintended result sets.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill accepts or sources gemini_api_url, gemini_api_key, gemini_token, and DB_DSN, then forwards them without any consent gate, scope restriction, or disclosure. If the downstream Python skill or external services are compromised or misused, these credentials could be exposed or used to access databases and paid APIs.

Missing User Warnings

High
Confidence
99% confidence
Finding
The code embeds a default Gemini token directly in source, which exposes a reusable credential to anyone with code access and may grant unauthorized access to the backing API. Hardcoded secrets are especially dangerous because they tend to propagate through repositories, logs, backups, and downstream forks long after intended use.

Credential Access

High
Category
Privilege Escalation
Content
## 依赖（通过 `.env` 配置）

| 服务 | .env 配置键 |
|------|-------------|
| StarRocks/Doris | `DB_HOST` / `DB_PORT`（默认 9030）/ `DB_USER` / `DB_PASSWORD` / `DB_NAME` |
| Gemini（兜底候选生成） | `GEMINI_API_URL` / `GEMINI_API_KEY` / `GEMINI_TOKEN` |
Confidence
76% confidence
Finding
.env

Credential Access

High
Category
Privilege Escalation
Content
const path = require('path');
const fs = require('fs');

// 加载 skills/.env
(function loadDotEnv() {
  const envFile = path.join(__dirname, '..', '.env');
  if (!fs.existsSync(envFile)) return;
Confidence
96% confidence
Finding
.env

Credential Access

High
Category
Privilege Escalation
Content
// 加载 skills/.env
(function loadDotEnv() {
  const envFile = path.join(__dirname, '..', '.env');
  if (!fs.existsSync(envFile)) return;
  for (const line of fs.readFileSync(envFile, 'utf8').split('\n')) {
    const m = line.match(/^\s*([A-Z_][A-Z0-9_]*)\s*=\s*(.+?)\s*$/);
Confidence
96% confidence
Finding
.env'

Credential Access

High
Category
Privilege Escalation
Content
function execPython(script, stdinData, skillDir) {
  return new Promise((resolve, reject) => {
    const proc = spawn(PYTHON_BIN, ['-c', script, skillDir], {
      env: { ...process.env },
    });

    let stdout = '';
Confidence
97% confidence
Finding
.env

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal