Db Explorer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:47 AM UTC
• Version: 2.4.0

Overview

This database helper is mostly coherent, but it includes live database credentials, export, restore, and migration workflows with safety gaps that could expose secrets or alter data if followed too literally.

Install only if you are comfortable with an agent handling live database credentials and potentially data-changing database workflows. Use read-only, least-privilege credentials where possible, avoid pasting passwords into command lines, use private temporary directories for exports, and require explicit confirmation plus target verification before any restore, import, migration, or full export.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:51

Finding

Database Credentials Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:51-65
Vulnerability Type: Credentials exposed in process arguments and shell history
Risk Level: Medium

Vulnerable Code

bash

# PostgreSQL
psql "postgresql://user:password@host:5432/dbname" -c "\dt"
psql "postgresql://user:password@host:5432/dbname" -c "\d table_name"
psql "postgresql://user:password@host:5432/dbname" -c "SELECT count(*) FROM table_name;"

# MongoDB
mongosh "mongodb://user:password@host:27017/dbname" --eval "db.getCollectionNames()"
mongosh "mongodb://user:password@host:27017/dbname" --eval "db.collection_name.countDocuments()"

# Redis
redis-cli -h host -p 6379 -a password INFO keyspace
redis-cli -h host -p 6379 -a password DBSIZE
redis-cli -h host -p 6379 -a password KEYS "*"

Technical Analysis

The documented commands place plaintext database passwords in command-line arguments. Depending on the shell and operating system, these values can be retained in shell history, captured by terminal or agent-execution logs, or observed through process-inspection interfaces while the command is running.

This behavior directly conflicts with the skill's stated safety rule that passwords must not be placed in history. Quoting a connection URI does not conceal it from shell history or process metadata.

Attack Path

1. A user supplies valid PostgreSQL, MongoDB, or Redis credentials.
2. The agent substitutes those credentials into one of the documented command examples.
3. The command is executed with the plaintext password in its argument vector.
4. A local user, monitoring utility, execution logger, or shell-history reader captures the command.
5. The recovered credentials are reused to connect to the database.

Impact Assessment

An attacker can obtain the same database access granted to the exposed account. Depending on that account's privileges, this may allow disclosure of database contents, modification or d ...[truncated 186 chars]

Remediation

View remediation

Remediation Suggestions

• Do not place plaintext passwords in command-line arguments or literal connection URIs.
• Use protected client configuration mechanisms such as PostgreSQL .pgpass or PGPASSFILE, MySQL login paths or restricted option files, MongoDB configuration files, and Redis ACL-aware protected configuration.
• Prefer an interactive password prompt when automation is unnecessary.
• If environment variables are required, scope them to a single process and unset them immediately afterward; recognize that some execution environments may log environment values.
• Ensure credential files are owned by the executing user and have mode 0600.
• Replace the examples with variable-based commands such as psql "$DATABASE_URL" and explicitly instruct users never to paste secrets into recorded command lines.
• Disable shell-history recording for unavoidable sensitive operations and ensure agent/tool telemetry redacts connection strings and password parameters.
• Use short-lived, least-privileged database credentials wherever supported.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:115

Finding

Predictable Shared Temporary Files Permit Data Disclosure and Symlink Attacks

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:115-125, SKILL.md:258, SKILL.md:264, and SKILL.md:274
Vulnerability Type: Unsafe predictable temporary-file handling
Risk Level: Medium

Vulnerable Code

bash

# CSV (PostgreSQL)
psql "$CONN" -c "\copy (SELECT * FROM table_name) TO '/tmp/export.csv' WITH CSV HEADER"

# CSV (MySQL)
mysql "$CONN" -e "SELECT * FROM table_name" | sed 's/\t/,/g' > /tmp/export.csv

# JSON (PostgreSQL)
psql "$CONN" -t -c "SELECT json_agg(t) FROM (SELECT * FROM table_name LIMIT 100) t;" > /tmp/export.json

# SQLite to CSV
sqlite3 /path/to/db.db ".mode csv" ".headers on" ".output /tmp/export.csv" "SELECT * FROM table_name;" ".quit"

bash

# Backup
sqlite3 /path/to/db.db ".backup /tmp/backup.db"

bash

# PostgreSQL to CSV to MySQL
psql "$PG_CONN" -c "\copy table_name TO '/tmp/export.csv' WITH CSV HEADER"
mysql "$MYSQL_CONN" -e "LOAD DATA LOCAL INFILE '/tmp/export.csv' INTO TABLE table_name FIELDS TERMINATED BY ',' ENCLOSED BY '\"' LINES TERMINATED BY '\n' IGNORE 1 ROWS;"

Technical Analysis

The skill repeatedly uses fixed filenames in the globally shared /tmp directory. Predictable names such as /tmp/export.csv, /tmp/export.json, and /tmp/backup.db can collide with files created by other users or earlier runs.

Shell redirection and some database-client output operations can follow symbolic links. In an environment without sufficient operating-system symlink protections, a local attacker can pre-create one of these paths as a symbolic link and cause the agent to overwrite another file writable by the agent. In addition, an insufficiently restrictive process umask may make exported database data readable by other local users.

Fixed names also allow concurrent skill executions to overwrite or consume each other's exports, potentially causing data corruption or cross-user disclosure.

Attack Path

1. An attacker predicts that t ...[truncated 907 chars]

Remediation

View remediation

Remediation Suggestions

• Create a unique private working directory with mktemp -d instead of using fixed /tmp filenames.
• Set a restrictive umask before creating exports or backups:

  bash

  umask 077
  workdir="$(mktemp -d)"
  

• Verify that temporary paths are regular files owned by the executing user and do not resolve through symbolic links.
• Use securely generated filenames and avoid reopening paths by name when a securely created file descriptor can be used.
• Set directory permissions to 0700 and export or backup file permissions to 0600.
• Add cleanup traps so sensitive artifacts are removed on success, failure, or interruption.
• Do not retain database exports longer than necessary; encrypt retained backups and define an explicit retention policy.
• Avoid concurrent jobs sharing a temporary path, and validate ownership and permissions before migration tools consume an intermediate file.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:59

Finding

Unquoted User-Supplied Paths and Identifiers Can Enable Command or Query Injection

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:59-61, SKILL.md:122, SKILL.md:239, and SKILL.md:263-267
Vulnerability Type: Unsafe interpolation of paths and database identifiers
Risk Level: Medium

Vulnerable Code

bash

# SQLite
sqlite3 /path/to/db.db ".tables"
sqlite3 /path/to/db.db ".schema table_name"
sqlite3 /path/to/db.db "SELECT count(*) FROM table_name;"

bash

# SQLite to CSV
sqlite3 /path/to/db.db ".mode csv" ".headers on" ".output /tmp/export.csv" "SELECT * FROM table_name;" ".quit"

bash

# Backup single table
pg_dump "$CONN" -t table_name > table_backup.sql

bash

# Backup
sqlite3 /path/to/db.db ".backup /tmp/backup.db"

# Or just copy
cp /path/to/db.db /tmp/backup_$(date +%Y%m%d).db

Technical Analysis

The skill asks users to provide SQLite file paths and database object names, but its examples show paths without shell quoting and identifiers inserted directly into SQL or command arguments.

If an agent directly substitutes an untrusted path into an unquoted shell command, whitespace and shell metacharacters can alter command parsing and introduce additional commands. Database identifiers such as table names cannot safely be protected using ordinary value-parameter placeholders; they require strict validation and database-specific identifier quoting. Direct textual insertion can change the intended query or cause a different database object to be accessed.

The vulnerability is conditional on the agent performing literal substitution into a shell command, but that is the workflow demonstrated by the skill.

Attack Path

1. An attacker or untrusted data source supplies a crafted SQLite path or table name.
2. The agent replaces /path/to/db.db or table_name in a documented command without validation.
3. For an unquoted path, the shell interprets embedded whitespace or metacharacters as command syntax.
4. For an identifier, t ...[truncated 678 chars]

Remediation

View remediation

Remediation Suggestions

• Quote every user-derived filesystem path and terminate option processing where supported:

  bash

  sqlite3 -- "$DB_PATH" ".tables"
  cp -- "$DB_PATH" "$DESTINATION"
  

• Reject paths containing NUL characters and normalize and validate paths against an explicitly permitted directory when access should be constrained.
• Pass shell arguments through structured process-execution APIs rather than constructing a command string for shell evaluation.
• Do not use eval, sh -c, or equivalent string-based command execution with user-controlled values.
• Validate table and schema names with a strict allowlist, such as accepting only identifiers discovered from database metadata.
• Apply database-native identifier quoting for the relevant engine. Do not confuse identifier quoting with prepared-statement value parameters.
• For pg_dump, pass a validated table identifier as a distinct argument and reject values that could be interpreted as additional command options.
• Add explicit instructions that placeholders must never be replaced through raw string concatenation.
• Execute database operations with read-only, least-privileged credentials to limit the consequences of malformed or injected queries.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill states that write operations require explicit confirmation, but later provides restore and import commands that perform immediate writes with no mandatory confirmation flow. This inconsistency is dangerous because agents often follow concrete examples over prose rules, leading to accidental data overwrite, import, or corruption.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The activation phrases are broad enough to match common requests like 'check the database' or 'show me the data,' which can trigger this powerful skill in ambiguous situations. Because the skill includes access to live databases and non-read-only procedures elsewhere in the file, overbroad activation materially increases the risk of unnecessary credential handling, sensitive data exposure, or unintended operational actions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill is presented as an exploration/query tool, but it also documents restore, backup, and migration workflows that can directly modify or overwrite data. In an agent setting, this expands capability beyond the declared scope and increases the chance that a user request for harmless inspection is translated into destructive or data-affecting operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Backup, restore, and migration instructions are presented as routine helpers without prominent warnings about destructive effects, overwrite risk, target-environment validation, or rollback limitations. In an agent workflow, omission of such warnings can cause the model to treat high-impact operational commands as normal next steps, increasing the chance of production data loss or unintended writes.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.