Security audit

SQL智能助手

Security checks for vulnerabilities and agentic risk

Overview

This SQL helper is mostly transparent about its database powers, but it gives agents broad execution, import, export, and batch instructions without adequate safety gates.

Review this skill carefully before installing. Use it only with least-privileged or read-only database credentials by default, require explicit confirmation for writes, imports, exports, batch files, or production databases, and avoid passing user SQL or paths through a shell command string.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:63
Finding: Shell Command Injection Through User-Controlled SQL and File Paths
Content: View full analysis
sql execute "" ``` ```bash dbskiter --output-mode=ai --database=<数据库名> sql import <文件路径> --table=<表名> --format=<格式> ``` ```bash dbskiter --output-mode=ai --database=<数据库名> sql batch <文件路径> ``` The execution workflow explicitly instructs the agent to insert user-provided SQL into a shell command: ```text 步骤1：提取用户提供的SQL 步骤2：执行 dbskiter --output-mode=ai --database= sql execute "" 步骤3：展示结果（最多50行）步骤4：告知总行数和耗时 ``` ### Technical Analysis The skill constructs command-line examples by directly embedding user-controlled SQL, database names, table names, and file paths into shell command strings. SQL is placed inside double quotes, while several file and identifier arguments are left unquoted. Shell double quotes do not neutralize command substitution. Constructs such as `$(command)` and backticks remain active inside double-quoted arguments. Unquoted file paths additionally allow shell separators, redirections, glob expansion, and other metacharacters to alter the intended command. The document does not require argument-array execution, shell avoidance, strict validation, or platform-appropriate escaping. If an agent follows these templates through a shell, specially crafted user input can cause commands to execute before `dbskiter` receives the resulting argument. ### Attack Path 1. An attacker asks the agent to execute SQL containing shell syntax, for example: ```sql SELECT '$(id > /tmp/dbskiter-command-injection)' ``` 2. Following the documented workflow, the agent constructs a command similar to: ```bash dbskiter --output-mode=ai --database=prod sql execute "SELECT '$(id > /tmp/dbskiter-command-injection)'" ``` 3. The shell evaluates `$(...)` b ...[truncated 1101 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:63
Finding: Unrestricted Execution of Destructive SQL Against Production Databases
Content: View full analysis
%(age)s" --params='{"age": 18}' # 限制返回行数 dbskiter --output-mode=ai --database=prod sql execute "SELECT * FROM orders" --limit=50 ``` The skill also permits importing data and executing arbitrary SQL files: ```bash dbskiter --output-mode=ai --database=<数据库名> sql import <文件路径> --table=<表名> --format=<格式> ``` ```bash # 批量执行SQL文件 dbskiter --output-mode=ai --database=prod sql batch queries.sql ``` Its decision process directs the agent to execute extracted SQL immediately: ```text 步骤1：提取用户提供的SQL 步骤2：执行 dbskiter --output-mode=ai --database= sql execute "" 步骤3：展示结果（最多50行）步骤4：告知总行数和耗时 ``` ### Technical Analysis The skill provides a generic SQL execution operation and directs the agent to run user-provided SQL without first classifying the statement, checking authorization, previewing mutations, or requesting confirmation. It also supports arbitrary SQL batch files and imports. Although the examples primarily show `SELECT` statements, the documented execution interface does not restrict operations to read-only queries. There are no controls addressing destructive statements such as `DROP`, `TRUNCATE`, `DELETE`, `UPDATE`, `ALTER`, or privilege-changing commands. The examples repeatedly use a database named `prod`, increasing the likelihood that the workflow will be applied to a production target. No transaction requirement, rollback procedure, affected-row threshold, statement allowlist, read-only credential policy, or separation between development and production databases is documented. ### Attack Path 1. An attacker or ...[truncated 1380 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The trigger phrases are broad enough that ordinary requests such as 'analyze data', 'schema', or 'run this SQL' may activate a powerful database skill without sufficient narrowing of user intent or environment. Because this skill can execute SQL and perform import/export operations, ambiguous activation increases the chance of unintended access to schemas, data exposure, or destructive execution in the wrong database context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly enables SQL execution, batch execution, import, and export against a named database, but it does not require confirmation, warn about destructive statements, or distinguish read-only from mutating operations. In an agent setting, broad execution guidance can lead to unintended data deletion, mass modification, sensitive data export, or filesystem impact through file-based import/export workflows.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.