SQL Master

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:56 AM UTC
• Version: 1.0.1

Overview

This SQL/data-analysis skill is mostly disclosed, but it needs review because some file-loading and companion-skill integration paths can run code and its database/file write authority is broad.

Review this skill before installing in a sensitive environment. Do not load untrusted .pkl or .pickle files, use read-only or least-privilege database accounts, verify output paths before exports, keep companion sql-dataviz/sql-report-generator skills trusted, and prefer pinned dependencies before production use.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (8)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/file_connector.py:128

Finding

Unsafe Pickle Deserialization Allows Arbitrary Code Execution

Content

View full analysis

pd.DataFrame: return pd.read_pickle(path, **kwargs) ``` ### Technical Analysis `pandas.read_pickle()` uses Python pickle deserialization. Pickle is an executable serialization format: a crafted object can invoke arbitrary callables through methods such as `__reduce__` during loading. The connector treats `.pkl` and `.pickle` files as ordinary supported data files without a trust check, warning, signature verification, or explicit unsafe-format opt-in. Consequently, merely loading an attacker-supplied file can execute code before a DataFrame is returned. ### Attack Path 1. An attacker creates a malicious pickle whose deserialization gadget runs an operating-system command or arbitrary Python code. 2. The attacker supplies the file to a user or places it in a directory processed by the Skill. 3. The Agent invokes `FileConnector`, `load_file()`, or a pipeline method on that file. 4. Extension dispatch selects `_load_pickle()`. 5. `pd.read_pickle()` deserializes the payload and executes the embedded callable. 6. The payload runs with the same operating-system identity and permissions as the Agent process. ### Impact Assessment Successful exploitation provides arbitrary code execution under the Agent process account. The attacker could read or modify files accessible to that account, access environment variables and database credentials, tamper with generated reports, invoke network connections, or compromise subsequent pipeline operations. The vulnerability does not itself elevate operating-system privileges, but it inherits all privileges available to the Skill runtime. ]]>

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/file_connector.py:350

Finding

SQL Injection Through Manual Parameter Substitution

Content

View full analysis

pd.DataFrame: self._ensure_sqlite() try: # 参数绑定支持 :name 和 ? if params: # sqlite3 不支持命名参数，直接替换 for k, v in params.items(): sql = sql.replace(f":{k}", f"'{v}'") return pd.read_sql(sql, self._sqlite_conn) except Exception as e: logger.error(f"SQL 查询失败: {e}\nSQL: {sql[:200]}") raise def sql_result(self, sql: str, params: Optional[Dict] = None): from .database_connector import QueryResult self._ensure_sqlite() import time t0 = time.perf_counter() try: if params: for k, v in params.items(): sql = sql.replace(f":{k}", f"'{v}'") df = pd.read_sql(sql, self._sqlite_conn) ``` ### Technical Analysis The code emulates parameter binding by directly replacing placeholders with quoted values. A value containing a quote can terminate the intended string literal and inject SQL syntax. The implementation also converts every value to a string, mishandles `NULL` and numeric types, can replace placeholder text in unintended locations, and may incorrectly replace prefixes such as `:id` inside `:id2`. SQLite and `pandas.read_sql()` support genuine bound parameters, so this substitution is unnecessary. The behavior directly contradicts the Skill documentation requiring parameterized queries. ### Attack Path 1. A query template includes a placeholder, such as `WHERE region = :region`. 2. An attacker controls the corresponding parameter value. 3. The value includes a quote followed by SQL syntax, such as a tautological condition or a subquery. 4. `str.replace()` inserts the value directly into the SQL text. 5. `pd.read_sql()` executes the altered query rather than treating the input as data. ...[truncated 571 chars]

Remediation

View remediation

pd.DataFrame: self._ensure_sqlite() return pd.read_sql(sql, self._sqlite_conn, params=params or {}) ``` Apply the same change to `sql_result()`. Additional hardening should include: - Accept only a single read-only `SELECT` or approved CTE query for file-analysis operations. - Open the temporary SQLite database with the minimum necessary capabilities. - Configure a SQLite authorizer if untrusted users can provide complete SQL statements. - Add tests using quotes, comment markers, placeholder prefixes, `NULL`, numbers, and Unicode values. - Avoid logging complete sensitive SQL or parameter values. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/database_connector.py:299

Finding

SQL Injection Through Unvalidated Table Identifiers

Content

View full analysis

pd.DataFrame: """获取表结构""" if self.dialect in ("sqlite", "sqlite3"): sql = f"PRAGMA table_info({table})" elif "postgresql" in self.dialect: sql = f""" SELECT column_name, data_type, is_nullable, column_default FROM information_schema.columns WHERE table_name = '{table}' ORDER BY ordinal_position """ elif "mysql" in self.dialect: sql = f"DESCRIBE `{table}`" else: sql = f""" SELECT COLUMN_NAME, DATA_TYPE, IS_NULLABLE, COLUMN_DEFAULT FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME = '{table}' """ return self.execute(sql).df def table_preview(self, table: str, limit: int = 5) -> pd.DataFrame: """预览表数据""" sql = f"SELECT * FROM `{table}` LIMIT {limit}" return self.execute(sql).df ``` Additional affected code includes: ```python if table_name: df = pd.read_sql(f"SELECT * FROM `{table_name}` LIMIT 1000000", conn) return df, conn, table_name ``` ```python tbl = table_name or tables[0] df = pd.read_sql(f"SELECT * FROM `{tbl}`", conn) ``` ### Technical Analysis Table names and, in `table_preview()`, the limit value are interpolated directly into SQL. Backticks do not make interpolation safe when an attacker can insert a backtick or other delimiter. The PostgreSQL and generic metadata branches place the table name directly inside a string literal. Ordinary value placeholders generally cannot bind identifiers, so identifiers must be validated against a strict grammar and quoted through a dialect-aware identifier API. The current implementation does neither. ### Attack Path 1. An attacker contro ...[truncated 938 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: references/hive-skew-advanced.md:446

Finding

Shell Command Injection in the Documented Hive Monitoring Script

Content

View full analysis

Remediation

View remediation

T07 · Tool Hijacking and Spoofing

Error

• Location: scripts/unified_pipeline.py:43

Finding

Sibling Skill Import-Path Hijacking Enables Arbitrary Module Execution

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/pipeline.py:306

Finding

Stored HTML Injection Through Unescaped Report Titles

Content

View full analysis

"SQLPipeline": self._ensure_output_dir(path) html = self._current_df.to_html(index=False, classes="table table-striped", border=0) full_html = f""" {title} ...

{title}

{html} """ with open(path, "w", encoding="utf-8") as f: f.write(full_html) ``` The report generator similarly embeds the title directly: ```python html_content = f""" {title} ...

{title}

``` The unified pipeline also writes it without escaping: ```python def to_html(self, path: str, title: str = "") -> "UnifiedPipeline": self._ensure_dir(path) html = self._current_df.to_html(index=False, classes="table", border=0) with open(path, "w", encoding="utf-8") as f: f.write(f"{title}" f"{html}") ``` ### Technical Analysis The `title` value is inserted directly into HTML element content without escaping. A crafted title can terminate the element and inject arbitrary HTML or script-capable markup. Because reports are saved to disk and may be shared or opened later, this is a stored injection issue. The exact browser impact depends on how the report is opened and the browser’s restrictions for local files, but script execution and content spoofing remain possible. ### Attack Path 1. An attacker influences a report title through an API request, dataset name, workflow parameter, or shared analysis configuration. 2. T ...[truncated 728 chars]

Remediation

View remediation

` element. Additional controls: - Generate reports through a templating engine with auto-escaping enabled. - Sanitize HTML returned by external chart and insight components before embedding it. - Apply a restrictive Content Security Policy, for example disallowing arbitrary scripts and remote connections. - Avoid marking untrusted text as safe markup. - Test titles containing angle brackets, quotes, event handlers, SVG markup, and closing tags. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/file_connector.py:51

Finding

Predictable Temporary Files Permit Symlink and Race Attacks

Content

View full analysis

'FileDataSource': import tempfile, uuid if db_path is None: db_path = tempfile.mktemp(suffix=".db") conn = sqlite3.connect(db_path) ``` ```python def _ensure_sqlite(self): if self._sqlite_conn is None: # 使用临时文件，避免内存过大 self._sqlite_db_path = tempfile.mktemp(suffix=".db") self._sqlite_conn = sqlite3.connect(self._sqlite_db_path) ``` Equivalent report paths are also created with `mktemp`: ```python out = output or tempfile.mktemp(suffix=".html") ``` ### Technical Analysis `tempfile.mktemp()` returns a pathname but does not atomically create the file. Between pathname generation and the later `sqlite3.connect()` or report write, another local process can create the path or replace it with a symbolic link. In a shared temporary directory, this creates a time-of-check/time-of-use race. The generated database may also contain a complete copy of sensitive imported data until `close()` is called; cleanup is not guaranteed if execution terminates unexpectedly. ### Attack Path 1. A local attacker monitors or predicts temporary filenames in the shared temporary directory. 2. Before the Skill opens the selected path, the attacker creates a file or symbolic link at that location. 3. The Skill opens the attacker-controlled target using SQLite or a report writer. 4. Sensitive data is written to a location selected by the attacker, or an accessible target file is overwritten or corrupted. 5. If cleanup follows the symlink or target relationship unexpectedly, additional data-integrity effects may occur. ### Impact Assessment Potential effects include disclosure of datasets copi ...[truncated 303 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:4

Finding

Unbounded and Unverified Dependency Resolution Creates Supply-Chain Exposure

Content

View full analysis

=1.5.0 numpy>=1.21.0 sqlalchemy>=1.4.0 pymysql>=1.0.0 psycopg2-binary>=2.9.0 openpyxl>=3.0.0 xlrd>=2.0.0 python-dotenv>=0.21.0 scipy>=1.9.0 ``` The Skill instructs users to install these dependencies automatically or with: ```bash pip install -r requirements.txt ``` ### Technical Analysis All dependencies use open-ended lower-bound constraints. Installation therefore resolves whatever newer release is available at installation time. No lockfile, artifact hash, trusted index configuration, or reviewed upper bound is provided. No typosquatted package name, suspicious package source, or malicious dependency was identified in the audited files. The risk is that future package compromise, repository compromise, or an incompatible release can change the code installed and executed without any change to the reviewed Skill package. ### Attack Path 1. A user invokes the documented automatic installation process. 2. The installer resolves the newest versions satisfying the open-ended constraints. 3. A compromised, malicious, or unexpectedly incompatible release is selected from the configured package index. 4. Package installation hooks or subsequently imported package code execute in the Skill environment. 5. The compromised dependency gains access to data and credentials available to the Agent process. ### Impact Assessment A compromised dependency can obtain arbitrary Python execution with the installer or runtime account’s privileges. This may expose database credentials, imported datasets, generated reports, and accessible files. The practical likelihood depends on package-index security and the integrity of the named upstream projects; the audit found no evidence that the project intentionally selected malicious packages. ]]>

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (55)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The skill bundles file/directory ingestion, DataFrame transformations, chart generation, AI insights, and HTML report export as an end-to-end pipeline, while the declared purpose emphasizes SQL assistance. In context, that makes the skill more dangerous because a seemingly narrow SQL helper can become a general local-data processing and export pipeline, widening the blast radius for sensitive data exposure.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The skill bundles file/directory ingestion, DataFrame transformations, chart generation, AI insights, and HTML report export as an end-to-end pipeline, while the declared purpose emphasizes SQL assistance. In context, that makes the skill more dangerous because a seemingly narrow SQL helper can become a general local-data processing and export pipeline, widening the blast radius for sensitive data exposure.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill bundles file/directory ingestion, DataFrame transformations, chart generation, AI insights, and HTML report export as an end-to-end pipeline, while the declared purpose emphasizes SQL assistance. In context, that makes the skill more dangerous because a seemingly narrow SQL helper can become a general local-data processing and export pipeline, widening the blast radius for sensitive data exposure.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The skill bundles file/directory ingestion, DataFrame transformations, chart generation, AI insights, and HTML report export as an end-to-end pipeline, while the declared purpose emphasizes SQL assistance. In context, that makes the skill more dangerous because a seemingly narrow SQL helper can become a general local-data processing and export pipeline, widening the blast radius for sensitive data exposure.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The skill bundles file/directory ingestion, DataFrame transformations, chart generation, AI insights, and HTML report export as an end-to-end pipeline, while the declared purpose emphasizes SQL assistance. In context, that makes the skill more dangerous because a seemingly narrow SQL helper can become a general local-data processing and export pipeline, widening the blast radius for sensitive data exposure.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The example helper builds a shell command by interpolating SQL into a string and executes it with shell=True. If the sql argument can be influenced by a user or upstream data, an attacker could break out of the quoted string and execute arbitrary OS commands on the host running the monitor, leading to command execution and possible data exfiltration or system compromise.

Content

Scanner excerpt · references/hive-skew-advanced.md (reported line 465)May include surrounding context.

md

]

def run_hive_query(sql):
    result = subprocess.run(
        f'{HIVE_CMD} "{sql}"',
        shell=True, capture_output=True, text=True
    )

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · requirements.txt (reported line 15)May include surrounding context.

text

# ── 文件数据获取层 ───────────────────────────────────────────────────────────
openpyxl>=3.0.0           # Excel (xlsx/xlsm) 读写
xlrd>=2.0.0               # Excel (xls) 读取
python-dotenv>=0.21.0     # .env 环境变量配置

# ── AI 洞察 & 统计（sql-report-generator 联动）────────────────────────────────────
scipy>=1.9.0              # 统计检验（t-test 等）

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Supporting Python pickle files introduces a deserialization primitive unrelated to normal SQL/data loading and enables arbitrary code execution if an attacker can influence the file being opened. In this skill context, users are encouraged to load many local formats, making this especially dangerous because the unsafe format is presented alongside ordinary data files.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Unsafe deserialization is exposed with no warning, guardrail, or trust boundary, increasing the likelihood that a user treats .pkl files as ordinary data inputs. Because pickle deserialization can execute attacker-controlled code, absence of warnings and restriction materially increases exploitability.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill advertises and documents file read/write and data export capabilities but does not declare any explicit tool scope or permissions boundary. In an agent environment, missing scope declarations can allow broader-than-expected access to local files and outputs, increasing the chance of unauthorized data exposure or destructive writes if the skill is invoked on sensitive paths.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger description includes very broad natural-language phrases such as generic requests to help write queries or explain slowness, which increases the chance the skill will activate in contexts the user did not intend. Because this skill also advertises file access, database connectivity, and export/report workflows, overbroad triggering can lead to unnecessary exposure of local data or execution of higher-risk operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation explicitly describes reading local files and directories, connecting to databases, executing queries, and exporting results to CSV/JSON/Excel/HTML, but it does not provide clear user-facing warnings about sensitive data handling, overwrite risk, credential safety, or destination control. In a data-access skill, that omission is materially dangerous because users may inadvertently expose confidential data, overwrite files, or export regulated information into less secure formats or locations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The PostgreSQL example includes pg_terminate_backend(pid) against active queries older than five minutes without any warning that it forcibly ends in-flight work. In a SQL helper skill, users may copy-paste this into production, causing aborted transactions, user-visible outages, or data-processing disruption if they do not understand the operational impact.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The MySQL example shows KILL QUERY <pid>; with no caution that it interrupts running statements and can break application workflows or long-running maintenance tasks. Because this skill is explicitly designed for direct SQL/CLI assistance, users are likely to treat the snippet as operational guidance and execute it without understanding the consequences.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

SQP-3 applies to all file types and covers language or locale policy violations. This markdown skill content forces a specific language for all instructions and examples, with no opt-in, alternative language, or documentation that the skill is intended only for a Chinese-speaking or region-specific audience.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The title and all instructional content are written exclusively in Chinese, which imposes a specific language on users without any visible opt-in, alternative locale, or justification that this skill is region-specific. The policy for natural-language violations applies to all file types, including markdown reference files like this one.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file contains user-facing instructional content exclusively in Chinese, and there is no indication that the skill is region-specific or that users may opt into another language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The document is entirely written in Chinese and instructs the agent when to load and use it, but it does not state that Chinese is optional or that the user can choose another language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger phrases are very broad generic requests like asking to 'draw a chart' or 'make a report', which can cause this skill to activate in many ordinary conversations beyond its intended scope. In an agent system, overly broad routing can lead to incorrect tool/skill selection, unnecessary code-generation guidance, and expanded exposure of downstream capabilities when a narrower skill would be safer or more appropriate.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The natural-language documentation and interface descriptions are presented only in Chinese, with no indication that users can choose another language or locale. Under the stated policy, forcing a specific language without opt-in is a locale/language policy violation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest emphasizes SQL querying, data retrieval, optimization, schema design, and visualization, which suggests an analytical assistant role. This file not only executes arbitrary DDL/DML through execute/execute_many and transaction support, but also writes query results to local CSV/Excel/JSON files, extending behavior from analysis into mutation and filesystem export.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The to_csv, to_excel, and to_json methods write query results to arbitrary filesystem paths, which can affect user data, but the code provides no confirmation prompt or user-facing disclosure at the point of write. The short docstrings only describe the format and do not warn that these methods will create or overwrite files.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The execute() docstring says it executes 'SQL 查询' and returns query results, yet the code explicitly detects non-result statements and commits them as writes. For a skill described primarily as query/data retrieval and SQL assistance, this is a meaningful behavior expansion from querying into database modification.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The module advertises and implements a generic local file ingestion and multi-format export layer, including CSV/Excel/JSON/Parquet conversion and chart/report handoff. The manifest describes a SQL query/data retrieval agent focused on SQL generation, optimization, explain analysis, indexing, modeling, error diagnosis, and visualization of query results; standalone file conversion is a broader behavior not clearly covered by that description.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file-level documentation and inline user-facing descriptions are entirely in Chinese, which imposes a specific language/locale without any opt-in or documented regional constraint. Under the policy, fixed language behavior should either offer a choice or be explicitly justified as region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.