ClawHub
Back to skill

Security audit

数据库锁分析与死锁检测

Security checks across malware telemetry and agentic risk

Overview

This appears to be a database lock-management skill, but it includes a transaction-kill workflow without enough clear user confirmation or scoping.

Install only if you intend to let the agent assist with live database lock operations. Before using any transaction-kill action, require the agent to show the exact database, session or transaction ID, expected impact, and a separate explicit confirmation from an authorized operator.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger phrases like “看锁”, “死锁”, “阻塞”, and especially “终止事务” are broad natural-language cues that can match ordinary conversation without confirming intent, database target, or authorization. In this skill, unintended invocation is more dangerous than usual because one mapped action (`lock kill <transaction_id>`) is destructive and could terminate live transactions, causing service disruption or data consistency issues.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The usage guidance instructs the agent to activate the skill whenever users mention certain keywords, but it does not define clear boundaries for intent detection, context disambiguation, or safety gates. In a database administration skill, this can cause the agent to run operational commands based on incidental mentions, and the risk is amplified by the presence of a destructive transaction-termination workflow.

VirusTotal

56/56 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.