Security audit

Db Explorer

Security checks for vulnerabilities and agentic risk

Overview

This database helper is mostly coherent, but it includes under-scoped commands that can expose credentials, export sensitive data, and restore or import into databases without enough safeguards.

Install only if you are comfortable reviewing every generated database command before execution. Use least-privilege or read-only credentials where possible, avoid putting passwords in command arguments or transcripts, do not export production data to shared temporary paths, and require a separate explicit confirmation before any restore, import, migration, or full-table export.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:49
Finding: Database credentials exposed through command-line arguments
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:121
Finding: Sensitive database exports written to predictable shared temporary files
Content: View full analysis
/tmp/export.csv # JSON (PostgreSQL) psql "$CONN" -t -c "SELECT json_agg(t) FROM (SELECT * FROM table_name LIMIT 100) t;" > /tmp/export.json # SQLite to CSV sqlite3 /path/to/db.db ".mode csv" ".headers on" ".output /tmp/export.csv" "SELECT * FROM table_name;" ".quit" ``` ### Technical Analysis The export examples use fixed filenames under the shared `/tmp` directory. Predictable temporary paths can create several security problems: - Other local users or processes can monitor or attempt to access the generated files. - Existing symbolic links or files at the predictable paths may redirect or interfere with writes. - Default file permissions may expose exported records, depending on the process umask and platform. - Temporary exports may persist after completion and remain recoverable. - Multiple concurrent executions can overwrite or corrupt each other's output. - The PostgreSQL, MySQL, and SQLite examples export an entire table without applying the Skill's stated default limit of 100 rows. The data written to these files may include credentials, personal information, financial records, access tokens, or other regulated information. ### Attack Path 1. A local attacker predicts that the Skill will use `/tmp/export.csv` or `/tmp/export.json`. 2. The attacker monitors the path or, where platform permissions permit, prepares a conflicting file or symbolic link. 3. The Agent runs an export against a database containing sensitive information. 4. The database client or shell writes the result to the predictable path. 5. The attacker reads the exported recor ...[truncated 744 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:263
Finding: SQLite backup written to a fixed shared temporary path
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The backup and especially restore instructions omit explicit warnings that restore/import operations can overwrite, append, or otherwise alter production data and may be difficult to reverse. In a tool-using agent, terse executable restore examples create a substantial risk of destructive execution against the wrong environment or with insufficient review.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation phrases are broad enough to match routine user requests like 'check the database' or 'show me the data,' which can cause the skill to trigger in many contexts without confirming scope, environment, or sensitivity. Because the skill contains destructive and exfiltration-capable procedures, overbroad activation increases the chance of unintended access, exports, or operational actions.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The document states 'read-only by default' and requires confirmation for writes, but later includes restore/import commands that perform writes without reiterating those safeguards. This inconsistency is dangerous because an agent may follow later concrete commands over earlier policy text, resulting in unauthorized data modification or overwrite.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The export section provides ready-to-run commands that can extract entire tables to local files without prominent warnings about sensitive data handling, destination control, or least-privilege use. In an agent context, this facilitates data exfiltration or accidental leakage of regulated data to insecure temporary paths.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill materially expands from exploration into restore and migration workflows that can modify databases and filesystem state, increasing capability beyond the advertised read-mostly use case. In an agent setting, these examples can normalize or trigger destructive actions such as restore/import against production systems without strong gating, especially when paired with broad activation cues.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: Commands like piping backups through 'gzip' and copying SQLite files with 'cp' introduce generic shell/file-management capabilities not inherent to querying or exploring databases. While related to backup workflows, they are not justified by the manifest's stated focus on database exploration, schema inspection, querying, export, and debugging.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.