Cockroach Labs

• Outcome: Pass
• Latest audit: Jun 16, 2026 at 10:57 PM UTC
• Version:
  1.0.0

Overview

This is a disclosed Cockroach Labs read-only connector skill that uses the OOMOL `oo` CLI and does not show hidden, destructive, or exfiltrating behavior.

Install this only if you want your agent to read CockroachDB Cloud metadata through an OOMOL-connected Cockroach Labs account. Review the OOMOL CLI setup and credential connection flow first, and avoid using it for unrelated Cockroach Labs questions where live account data is not needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger text is overly broad: it directs the agent to use this skill for ANY Cockroach Labs request and instead of calling the API directly. That can cause unintended invocation in loosely related contexts, increasing the chance of unnecessary connector access, data exposure, or bypass of more appropriate safer tools or narrower workflows.

VirusTotal

63/63 vendors flagged this skill as clean.