Security audit

Sqlite Client

Security checks for vulnerabilities and agentic risk

Overview

This SQLite skill is mostly coherent, but it gives agents write-capable database tools and row-preview helpers without enough safeguards around destructive changes or sensitive data exposure.

Install only if you are comfortable giving the agent write-capable access to SQLite files. Prefer read-only copies for inspection, back up databases before migrations or UPDATE/DELETE queries, and avoid running the sample-row inspector on production or sensitive databases unless you are willing for records to appear in logs/output.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/inspect.js:27
Finding: SQL Injection Through the Unescaped --table Argument
Content: View full analysis
Remediation: View remediation
object.name)) if (!validNames.has(tableName)) { throw new Error('Unknown table or view') } const quotedTable = quoteIdentifier(tableName) const columns = await db.all(`PRAGMA table_info(${quotedTable})`) const rowCount = await db.get(`SELECT COUNT(*) AS count FROM ${quotedTable}`) const sampleRows = await db.all(`SELECT * FROM ${quotedTable} LIMIT 5`) const indexes = await db.all(`PRAGMA index_list(${quotedTable})`) ``` 4. Open databases in read-only mode for inspection operations: ```js const db = await open({ filename: dbPath, mode: sqlite3.OPEN_READONLY, driver: sqlite3.Database }) ``` 5. Add security tests covering table names containing double quotes, comment markers, semicolons, whitespace, and SQL keywords. 6. Apply query timeouts or operational limits where untrusted users can invoke the script against large databases. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill explicitly encourages creating, modifying, and deleting SQLite data but does not warn users that these actions can permanently alter or destroy database contents. In an agent context, this increases the risk of unintended destructive operations against real .db files, especially when the agent is asked to inspect databases and may run write-capable examples without clear safeguards.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This markdown file documents db.migrate(config) and includes a force?: boolean option described as forcing rollback and re-running the latest migration. Because this behavior can modify or revert database state, the documentation should explicitly warn users about potential data loss or irreversible changes before presenting the option.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script deliberately prints the first five rows of a selected table, which can expose sensitive records such as credentials, tokens, personal data, or internal business data to terminal logs, CI output, or downstream consumers. In a database inspection skill, this behavior is especially risky because users may run it against production or unknown databases and the tool provides no warning, consent gate, or masking before disclosure.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.