Db Explorer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:59 AM UTC
• Version: 2.3.0

Overview

This database helper is mostly coherent, but it gives agents powerful database export, restore, and migration instructions with weak safeguards for credentials, temporary files, and destructive operations.

Install only if you are comfortable with the agent handling database credentials and potentially sensitive records. Before use, require explicit confirmation for any export, restore, import, migration, or write; avoid production targets unless intended; use protected credential mechanisms instead of passwords in command arguments; write exports to private, permission-restricted paths; and clean up backup/export files after the task.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:49

Finding

Database credentials exposed through command-line arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 49–70
Vulnerability Type: Credentials exposed in process arguments and shell history
Risk Level: Medium

Vulnerable Code

bash

# PostgreSQL
psql "postgresql://user:password@host:5432/dbname" -c "\dt"           # list tables
psql "postgresql://user:password@host:5432/dbname" -c "\d table_name" # describe table
psql "postgresql://user:password@host:5432/dbname" -c "SELECT count(*) FROM table_name;"

bash

# MongoDB
mongosh "mongodb://user:password@host:27017/dbname" --eval "db.getCollectionNames()"
mongosh "mongodb://user:password@host:27017/dbname" --eval "db.collection_name.countDocuments()"

bash

# Redis
redis-cli -h host -p 6379 -a password INFO keyspace
redis-cli -h host -p 6379 -a password DBSIZE
redis-cli -h host -p 6379 -a password KEYS "*"

Technical Analysis

The documented command templates place database passwords directly in command-line arguments. If an agent substitutes actual credentials into these templates, those credentials may become visible through:

• Shell command-history files
• Process argument inspection
• Process-monitoring and diagnostic tools
• Terminal session recording
• Agent execution logs or command telemetry
• Error reports that reproduce the invoked command

This behavior also conflicts with the skill's line 80 safety rule, which states that passwords should not be placed in history. A connection URI containing a password remains unsafe when the URI is passed directly as a command-line argument.

The examples contain placeholders rather than real embedded credentials, but they encourage an insecure credential-handling pattern that can expose real secrets during use.

Attack Path

1. A user provides valid PostgreSQL, MongoDB, or Redis credentials to the agent.
2. The agent substitutes those credentials into one of the documented command templates.
3. The shell, ...[truncated 1073 chars]

Remediation

View remediation

Remediation Suggestions

• Remove all examples that place passwords directly in connection URIs or command arguments.
• Use each client's protected credential mechanism:
  • PostgreSQL: .pgpass or PGPASSFILE with restrictive file permissions.
  • MySQL: mysql_config_editor and encrypted login paths.
  • MongoDB: interactive password prompting or a protected configuration mechanism.
  • Redis: REDISCLI_AUTH or a protected configuration file rather than -a.
• Ensure generated credential files are owned by the executing user and use mode 0600.
• Disable shell history while handling secrets where appropriate, while recognizing that this does not prevent process-argument exposure.
• Redact credentials from terminal output, execution logs, error reports, and agent responses.
• Prefer short-lived, narrowly scoped database credentials.
• Add an explicit rule prohibiting passwords in command arguments, rather than recommending connection strings as a safe alternative.

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:121

Finding

Unbounded database exports written to predictable temporary files

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 121–130 and 263–269
Vulnerability Type: Unsafe temporary-file handling and unrestricted data export
Risk Level: Low

Vulnerable Code

bash

# CSV (PostgreSQL)
psql "$CONN" -c "\copy (SELECT * FROM table_name) TO '/tmp/export.csv' WITH CSV HEADER"

# CSV (MySQL)
mysql "$CONN" -e "SELECT * FROM table_name" | sed 's/\t/,/g' > /tmp/export.csv

# JSON (PostgreSQL)
psql "$CONN" -t -c "SELECT json_agg(t) FROM (SELECT * FROM table_name LIMIT 100) t;" > /tmp/export.json

# SQLite to CSV
sqlite3 /path/to/db.db ".mode csv" ".headers on" ".output /tmp/export.csv" "SELECT * FROM table_name;" ".quit"

bash

# PostgreSQL to CSV to MySQL
psql "$PG_CONN" -c "\copy table_name TO '/tmp/export.csv' WITH CSV HEADER"
mysql "$MYSQL_CONN" -e "LOAD DATA LOCAL INFILE '/tmp/export.csv' INTO TABLE table_name FIELDS TERMINATED BY ',' ENCLOSED BY '\"' LINES TERMINATED BY '\n' IGNORE 1 ROWS;"

Technical Analysis

Several examples export complete tables using SELECT * or \copy table_name without a row limit. This is inconsistent with the skill's stated read-limit policy and can produce unexpectedly large files containing sensitive records.

The exports use fixed, predictable paths such as /tmp/export.csv and /tmp/export.json. The instructions do not create a private directory, enforce restrictive file permissions, verify that the destination is not a symbolic link, or clean up the exported data afterward.

On a multi-user system, predictable shared-directory paths can lead to:

• Unauthorized reading when the resulting file permissions are too permissive
• File collisions between concurrent executions
• Overwriting of an earlier export
• Redirection through a pre-created symbolic link, subject to the behavior and privileges of the invoked client
• Persistent plaintext copies of sensitive database records
• Disk-space exhaustion from unbound ...[truncated 1521 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit user approval before exporting an entire table.
• Apply a bounded query such as LIMIT 100 by default and require the user to request larger exports deliberately.
• Create a private temporary directory using a secure facility such as mktemp -d.
• Set the process umask to 077 before creating files and ensure export files use mode 0600.
• Generate unique, unpredictable filenames instead of fixed /tmp/export.csv and /tmp/export.json paths.
• Refuse to use an existing destination and verify that the destination is not a symbolic link.
• Store exports only for as long as required and securely remove them after use.
• Display the estimated row count and expected export size before executing a full export.
• For migrations, validate the temporary file's ownership, permissions, type, and integrity before importing it into the destination database.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The backup and especially restore commands are presented as routine operations, but restore is a write action that can overwrite or corrupt live data if run against the wrong target or without validation. Because the skill context is database administration, these commands are plausible and powerful, making omission of explicit destructive warnings particularly dangerous.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Activation phrases like 'check the database' or 'show me the data' are broad and common, so the skill may trigger in situations where the user did not intend database access or command execution. In a skill with capabilities to query, export, back up, and restore, overbroad activation materially raises the risk of unnecessary access to sensitive systems and data.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The safety section promises confirmation and transaction safeguards for writes, but later restore/import examples execute direct write operations without those protections. This inconsistency is dangerous because downstream agents may trust the stated safety model while following examples that can overwrite data immediately and irreversibly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The export guidance writes data to local files in /tmp without explicit warnings about data sensitivity, file creation, retention, or access controls. Exporting database contents can create new copies of sensitive data outside the database's security boundary, increasing exposure even when the original query is read-only.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill is presented as an exploration/query/export tool, but it also documents restore and migration commands that perform writes and can materially alter databases. That scope expansion increases the chance an agent will invoke destructive capabilities under an exploratory pretext, violating least surprise and weakening user consent boundaries.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.