T09 · Insecure Skill Coding Practices
Error
- Location
scripts/database_connector.py:95- Finding
Unrestricted Database Statements Bypass Advertised Safety Controls
- Content
View full analysis
int: """ Execute an UPDATE/INSERT/DELETE statement. Args: sql: SQL statement params: Statement parameters Returns: Number of affected rows """ if not self.connection: raise RuntimeError("Not connected to database") with self.connection.cursor() as cursor: affected_rows = cursor.execute(sql, params) self.connection.commit() return affected_rows ``` ```python def explain_query(self, sql: str) -> str: """Get execution plan for a query.""" db_type = self.config.get('type', 'mysql') if db_type == 'mysql': explain_sql = f"EXPLAIN {sql}" elif db_type == 'postgresql': explain_sql = f"EXPLAIN ANALYZE {sql}" result = self.execute_query(explain_sql) return json.dumps(result, indent=2) ``` ```python elif args.action == 'query': if not args.sql: print("Error: --sql required for query action") return result = connector.execute_query(args.sql) print(json.dumps(result, indent=2)) elif args.action == 'explain': if not args.sql: print("Error: --sql required for explain action") return plan = connector.explain_query(args.sql) print(plan) ``` ### Technical Analysis The connector accepts arbitrary SQL without parsing or restricting its statement type. It does not enforce a single-statement policy, a read-only transaction, an affected-row threshold, user confirmation, or the separate `DataCorrectionValidator`. The `execute_update` method commits immediately after executing caller-supplied SQL. This defeats the Skill's documented requirements to validate modifications, create a b ...[truncated 1731 chars]- Remediation
View remediation