SQL Connector

• Outcome: Review
• Latest audit: May 29, 2026 · 9:36 PM UTC
• Version: 2.2.0

Overview

This is a real SQL Server connector, but it needs Review because it can give an agent broad database read/write power with weak scoping and under-disclosed credential handling.

Install only if you intentionally want agents to access SQL Server. Use a dedicated least-privilege account, prefer read-only credentials unless writes are required, keep .env out of repositories and shared workspaces, pin reviewed dependency versions, and require human approval for INSERT, UPDATE, DELETE, migration, or cross-backend copy operations.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill documentation exposes environment-based credential use and installation/usage patterns, but it does not declare permissions for access to environment variables or shell-related capability despite clearly depending on them. In an agent ecosystem, undeclared capabilities weaken transparency and policy enforcement, making it easier for a skill to access sensitive secrets or invoke installation flows without informed approval.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 72% confidence
• Finding: The documented purpose describes a generic execute/query/scalar SQL transport, but the detected behavior includes dynamic backend resolution from environment variables and an additional connectivity/self-test capability that are not disclosed. That mismatch increases risk because operators may approve the skill for limited DB access while it can select arbitrary configured targets or perform network-reachability actions outside the stated interface.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The documentation says the skill is 'stable, production-ready', 'battle-tested', and 'used in production daily' while the manifest explicitly labels it ALPHA and warns 'use at your own risk'. This mismatch can cause operators to deploy immature database connectivity code into production with unjustified trust, increasing the chance of outages, unsafe handling of credentials, or misuse of write-capable APIs.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The README presents the package as 'STABLE' and 'Battle-tested in production' while the skill metadata explicitly says 'ALPHA: use at your own risk.' This can mislead users and automated agents into assigning unjustified trust, increasing the likelihood that they deploy immature code in sensitive environments without sufficient review or safeguards.

Intent-Code Divergence

Medium

• Confidence: 86% confidence
• Finding: The versioning section repeats claims that releases are stable, production-ready, and thoroughly tested, directly conflicting with the manifest's ALPHA warning. Such contradictory trust signaling is dangerous in a database connector because agents may grant broad access to live databases based on inaccurate maturity claims.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The guide instructs users to place SQL usernames and passwords in a workspace .env file and even shows realistic plaintext password examples, but it does not warn against committing the file, exposing it to other agents, or storing long-lived production credentials in plaintext. In an agent workspace context, this is especially risky because shared working directories, logs, backups, and repository sync can leak secrets and enable unauthorized database access.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The examples perform INSERT and UPDATE operations against production-style tables such as memory.Memories without clear warnings that they mutate persistent data. Users may copy-paste these examples into real environments, causing unintended data modification, corruption of agent memory state, or writes against production databases during testing.

Missing User Warnings

Medium

• Confidence: 81% confidence
• Finding: The documentation advertises write-capable methods like execute() for INSERT/UPDATE/DELETE without prominently warning that they can alter or destroy database data. In an agent skill context, this is more dangerous because autonomous or semi-autonomous consumers may invoke the skill based on examples alone and unintentionally perform destructive operations against real databases.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The markdown explicitly demonstrates write operations and lists required database credential variables, but it does not warn that the skill can modify persistent data or that the environment variables contain sensitive secrets. In agent-driven contexts, omission of these warnings can lead to unsafe use, accidental destructive writes, or careless handling of high-value DB credentials.

Credential Access

High

• Category: Privilege Escalation

Content

def _find_env() -> str | None:
    p = _pathlib.Path(os.path.abspath(__file__)).parent
    for _ in range(5):
        c = p / '.env'
        if c.exists():
            return str(c)
        p = p.parent

• Confidence: 82% confidence
• Finding: The _find_env() helper walks up to five parent directories searching for a .env file and will load the first one found. In a shared or untrusted filesystem layout, this can cause the connector to ingest attacker-controlled credentials or configuration from an unexpected parent directory, leading to unauthorized database connections or secret confusion.

Credential Access

High

• Category: Privilege Escalation

Content

_env_loaded = False

def _ensure_env_loaded() -> None:
    """Load .env once, lazily, on first connector creation."""
    global _env_loaded
    if not _env_loaded:
        _env = _find_env()

• Confidence: 88% confidence
• Finding: _ensure_env_loaded() automatically loads the discovered .env with override=True, meaning values from the file replace existing environment variables. If an attacker can place or influence the located .env file, they can silently redirect connections or swap credentials, undermining trusted runtime configuration.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pymssql>=2.2.0
python-dotenv>=1.0.0

• Confidence: 87% confidence
• Finding: The dependency is only lower-bounded and not pinned, so builds may resolve to different versions over time, including newly introduced vulnerable or incompatible releases. In a database connectivity skill, supply-chain drift is more sensitive because the package mediates access to SQL Server and may handle credentials, queries, and network connections.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pymssql>=2.2.0
python-dotenv>=1.0.0

• Confidence: 93% confidence
• Finding: python-dotenv is unpinned, which allows uncontrolled dependency resolution and increases exposure to future vulnerable releases or breaking behavior. This is more concerning here because environment-loading libraries often interact with secrets and configuration used for database authentication.

Known Vulnerable Dependency: python-dotenv — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 76% confidence
• Finding: The referenced advisory indicates python-dotenv's set_key may follow symlinks, potentially allowing arbitrary file overwrite if an attacker can influence the target .env path or filesystem layout. In this skill's context, the risk is somewhat reduced because requirements.txt alone does not prove set_key is used, but if the package is present and later used to modify environment files in an attacker-controlled path, it could enable configuration tampering or limited privilege escalation.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.