T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:49- Finding
Database Credentials Exposed Through Command-Line Arguments
- Content
View full analysis
- Remediation
View remediation
Security audit
Db Explorer
Security checks for vulnerabilities and agentic risk
Overview
This database skill is not malicious, but it needs Review because it includes high-impact backup, restore, migration, credential, and export guidance without enough scoping and safeguards.
Install only if you are comfortable supervising database operations closely. Use read-only, least-privilege credentials by default; avoid putting passwords in command lines; approve any export, backup, restore, or migration explicitly; choose protected output locations; and do not run it against production data without confirming scope and rollback plans.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:121- Finding
Sensitive Database Exports and Backups Written to Predictable Shared Temporary Files
- Content
View full analysis
/tmp/export.csv # JSON (PostgreSQL) psql "$CONN" -t -c "SELECT json_agg(t) FROM (SELECT * FROM table_name LIMIT 100) t;" > /tmp/export.json # SQLite to CSV sqlite3 /path/to/db.db ".mode csv" ".headers on" ".output /tmp/export.csv" "SELECT * FROM table_name;" ".quit" ``` Additional affected examples include: ```bash sqlite3 /path/to/db.db ".backup /tmp/backup.db" # Or just copy cp /path/to/db.db /tmp/backup_$(date +%Y%m%d).db ``` ```bash psql "$PG_CONN" -c "\copy table_name TO '/tmp/export.csv' WITH CSV HEADER" mysql "$MYSQL_CONN" -e "LOAD DATA LOCAL INFILE '/tmp/export.csv' INTO TABLE table_name FIELDS TERMINATED BY ',' ENCLOSED BY '\"' LINES TERMINATED BY '\n' IGNORE 1 ROWS;" ``` ### Technical Analysis The examples use fixed or predictable filenames in the shared `/tmp` directory. In a multi-user or insufficiently isolated environment, another local principal may anticipate these paths, monitor them, read files created with permissive modes, overwrite existing files, or attempt a symbolic-link attack against commands that follow links. Several examples also export complete tables using `SELECT *` without a result limit. This contradicts the skill's stated default limit policy and may copy substantially more sensitive data than needed. Full-table exports can additionally consume excessive disk space, memory, database I/O, and network capacity. ### Attack Path 1. An attacker with local access anticipates a documented filename such as `/tmp/export.csv`, `/tmp/export.json`, or `/tmp/backup.db`. 2. The attacker monitors the path, creates a ...[truncated 1166 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill claims to be read-only by default, but later sections provide direct restore and import commands that write to databases without preserving the same confirmation and transaction safeguards. This mismatch can cause an agent or operator to over-trust the skill and execute destructive changes under the assumption that the documented safety model still applies.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The backup, restore, and migration sections document operations that can overwrite data, duplicate data into other systems, or impose significant load, yet they lack strong warnings and approval requirements. These are operationally sensitive tasks where omission of safeguards makes accidental destructive changes and bulk exfiltration substantially more likely.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The early guidance encourages connecting, exploring schemas, and exporting data but does not prominently warn about sensitive data exposure such as PII, secrets, access tokens, or production records. In practice, database exploration and export are high-risk operations because even read-only access can reveal confidential information and enable large-scale data exfiltration.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The activation cues are broad enough that ordinary requests like 'check the database' or mentioning a DB name may invoke the skill prematurely. In an agent setting, over-broad triggering can lead to unnecessary connection attempts, credential requests, or execution of database inspection commands in contexts where the user did not intend database access.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill’s stated purpose is database exploration and querying, but the documentation also enables backup, restore, and cross-database migration. Those capabilities materially expand the blast radius from read-oriented inspection into bulk data exfiltration, overwrite, and replication operations, increasing the chance an agent uses the skill for destructive or high-impact actions the user did not clearly intend.
- Content
Static analysis
No suspicious patterns detected.