Seekdb

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:14 AM UTC
• Version: 0.3.0

Overview

This appears to be a legitimate SeekDB install/build helper, but it includes privileged system changes and unsafe cleanup/package-source steps that need careful review.

Install only if you intend to let an agent install and manage a local database service. Review every command first, avoid the APT '[trusted=yes]' path unless replaced with a signed HTTPS repository, confirm before enabling persistent services or firewall rules, and back up SeekDB data before running any cleanup or uninstall script.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (12)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly directs the agent to automatically inspect the host environment and execute shell commands before obtaining clear user consent or giving an upfront warning. Even though the listed commands are relatively low risk, automatic local probing reveals system details and normalizes unsandboxed command execution, which can violate user expectations and become dangerous if the workflow or referenced steps later expand to more invasive commands.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The instructions add an APT source with `[trusted=yes]`, which disables normal package signature verification for that repository, then immediately install a package as root. If the mirror is compromised or traffic is intercepted, a user could install a malicious package with full system privileges. In an installation skill, this context makes the issue more dangerous because users are likely to copy-paste the commands verbatim.

Missing User Warnings

Low

• Confidence: 72% confidence
• Finding: Starting and enabling the service causes SeekDB to run immediately and persist across reboots, which changes the host's runtime and boot behavior. While common in installation docs, omitting a warning can surprise users and expose a network service earlier than intended, especially on shared or production systems.

Missing User Warnings

High

• Confidence: 94% confidence
• Finding: The uninstall step runs a root-owned cleanup script from the filesystem without describing what it deletes or warning about irreversible data loss. If the script removes data directories or has been modified, executing it with `sudo bash` could destroy data or run arbitrary code as root. The admin/install context increases risk because users may trust and run the command without inspection.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The uninstall script permanently deletes the SeekDB data directory with `rmdir /s /q "C:\ProgramData\seekdb"` but the surrounding instructions do not clearly warn the user that all database contents will be irreversibly destroyed. In an agent-driven workflow, users may treat 'uninstall' as removing software only, so omitting an explicit data-loss warning increases the risk of accidental destructive action.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- MySQL port: `127.0.0.1:2881`
- Config file: `/etc/seekdb/seekdb.cnf`
- Service management: `sudo systemctl {start|stop|status} seekdb`
- Uninstall: `sudo apt remove seekdb && sudo bash /var/lib/seekdb/seekdb_clean.sh`

---

• Confidence: 91% confidence
• Finding: sudo

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- MySQL port: `127.0.0.1:2881`
- Config file: `/etc/seekdb/seekdb.cnf`
- Service management: `sudo systemctl {start|stop|status} seekdb`
- Uninstall: `sudo apt remove seekdb && sudo bash /var/lib/seekdb/seekdb_clean.sh`

---

• Confidence: 91% confidence
• Finding: sudo

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- MySQL port: `127.0.0.1:2881`
- Config file: `/etc/seekdb/seekdb.cnf`
- Service management: `sudo systemctl {start|stop|status} seekdb`
- Uninstall: `sudo yum erase seekdb && sudo bash /var/lib/seekdb/seekdb_clean.sh`

---

• Confidence: 88% confidence
• Finding: sudo

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- MySQL port: `127.0.0.1:2881`
- Config file: `/etc/seekdb/seekdb.cnf`
- Service management: `sudo systemctl {start|stop|status} seekdb`
- Uninstall: `sudo yum erase seekdb && sudo bash /var/lib/seekdb/seekdb_clean.sh`

---

• Confidence: 88% confidence
• Finding: sudo

Chaining Abuse

High

• Category: Tool Misuse

Content

- MySQL port: `127.0.0.1:2881`
- Config file: `/etc/seekdb/seekdb.cnf`
- Service management: `sudo systemctl {start|stop|status} seekdb`
- Uninstall: `sudo apt remove seekdb && sudo bash /var/lib/seekdb/seekdb_clean.sh`

---

• Confidence: 83% confidence
• Finding: && sudo

Chaining Abuse

High

• Category: Tool Misuse

Content

- MySQL port: `127.0.0.1:2881`
- Config file: `/etc/seekdb/seekdb.cnf`
- Service management: `sudo systemctl {start|stop|status} seekdb`
- Uninstall: `sudo yum erase seekdb && sudo bash /var/lib/seekdb/seekdb_clean.sh`

---

• Confidence: 84% confidence
• Finding: && sudo

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

echo       MSI uninstall exit code: %ERRORLEVEL%

echo [4/4] Cleaning data directory...
rmdir /s /q "C:\ProgramData\seekdb" 2>nul
echo       Done.

echo.

• Confidence: 92% confidence
• Finding: rmdir /s /

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.