ClawHub
Back to skill

Security audit

数据库实例巡检与报告生成

Security checks across malware telemetry and agentic risk

Overview

This MySQL helper is coherent, but it can run database-changing commands and does not clearly require confirmation or scoping before production or destructive actions.

Install only if you intend to let the agent help with MySQL operations. Before using it, require explicit confirmation of host, database, environment, account, target tables, and whether the task is read-only or write-capable. Prefer read-only database users for inspection, use SSL for production, avoid storing broad credentials, and require backups or rollback plans before UPDATE, DELETE, import, export, or schema-management commands.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
86% confidence
Finding
The trigger phrase '巡检' is broad enough to activate the skill for ambiguous user requests without requiring confirmation of target database, scope, or intended action. In a database-inspection context, over-broad activation can cause unintended execution of diagnostic or reporting commands against the wrong environment, exposing metadata or performing unauthorized operational actions.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The activation rules tell the agent to use the skill whenever listed keywords appear, but they do not define non-activation boundaries, disambiguation rules, or preconditions. In this skill's context, that increases the risk of unintended command execution, especially because the commands operate on databases and may reveal configuration, security, performance, or risk information that should only be accessed with clear user intent.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.