Security audit

Db Explorer

Security checks for vulnerabilities and agentic risk

Overview

This database skill is mostly coherent, but it includes high-impact restore, migration, credential, and export examples that need careful review before use.

Review this skill before installing. Use read-only, least-privilege database accounts; avoid putting passwords directly in commands; avoid running restore or migration examples against production unless you have a verified plan and explicit confirmation; and replace shared /tmp export paths with private, access-controlled temporary directories.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:49
Finding: Database Credentials Exposed Through Command-Line Arguments
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:121
Finding: Predictable Shared Temporary Files Used for Database Exports
Content: View full analysis
/tmp/export.csv # JSON (PostgreSQL) psql "$CONN" -t -c "SELECT json_agg(t) FROM (SELECT * FROM table_name LIMIT 100) t;" > /tmp/export.json # SQLite to CSV sqlite3 /path/to/db.db ".mode csv" ".headers on" ".output /tmp/export.csv" "SELECT * FROM table_name;" ".quit" ``` A similar fixed export path is also used during migration at lines 268–269: ```bash psql "$PG_CONN" -c "\copy table_name TO '/tmp/export.csv' WITH CSV HEADER" mysql "$MYSQL_CONN" -e "LOAD DATA LOCAL INFILE '/tmp/export.csv' INTO TABLE table_name FIELDS TERMINATED BY ',' ENCLOSED BY '\"' LINES TERMINATED BY '\n' IGNORE 1 ROWS;" ``` ### Technical Analysis The examples write potentially sensitive database records to fixed filenames in the globally shared `/tmp` directory. Predictable shared paths create several risks: - A prior export can be overwritten without warning. - Files may be created with permissions that expose data to other local users, depending on the active `umask`. - Another local user may pre-create the destination or, where operating-system protections permit, place a symbolic link at the expected path. - A symlink-following write can redirect the export to another file writable by the user running the command. - Stale exports may remain on disk after the task completes. - Concurrent executions can overwrite or consume one another’s data. The migration workflow additionally trusts the fixed file between export and import. A local process able to replace or modify that file could influence the data loaded into the destination database. ### Attack Path 1. An attacker with ...[truncated 1317 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:256
Finding: Predictable Shared Temporary Files Used for Database Backups
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The safety section says write operations require explicit confirmation, but later restore and migration commands are provided as ready-to-run examples with no confirmation, dry-run, or rollback guidance. This inconsistency can cause an agent or user to treat dangerous commands as routine operational steps, leading to accidental data overwrite, corruption, or unauthorized imports.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation phrases are broad enough to match common troubleshooting or data-related requests, which can cause the skill to activate in contexts where the user did not intend database access. Because this skill can expose schemas, row contents, credentials usage patterns, and even administrative operations, overbroad triggering increases the risk of unnecessary sensitive-data access or escalation into higher-risk actions.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill is framed as a database exploration/querying tool, but it also embeds restore, backup, and migration procedures that can materially change database state or move sensitive data. In an agent setting, this scope expansion increases the chance the skill is invoked for benign inspection tasks but then enables destructive or high-impact operations without clear separation of privileges or intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Restore and migration commands are documented without prominent user-facing warnings even though they can overwrite data, import untrusted content, or alter production systems. In a terminal-oriented skill, examples are often copied verbatim, so missing warnings materially increases the likelihood of accidental destructive execution.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.