T09 · Insecure Skill Coding Practices
Error
- Location
docker-compose.yml:7- Finding
Predictable Default MySQL Root Password
- Content
View full analysis
- Remediation
View remediation
Security audit
Mysql Manager
Security checks for vulnerabilities and agentic risk
Overview
This skill matches its MySQL-management purpose, but it ships unsafe default root credentials and broad database-changing triggers that could affect shared local data.
Review before installing. Use this only for trusted local development, set MYSQL_ROOT_PASSWORD to a strong non-default value before first start, rotate any existing volume initialized with secret, and avoid sharing the Docker network with untrusted containers. Treat create, dump, and drop operations as real database mutations even though the skill is framed for development use.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
run.sh:58- Finding
MySQL Root Password Exposed Through Process Arguments
- Content
View full analysis
/dev/null } wait_ready() { echo "Aguardando MySQL ficar pronto..." until docker exec "$MYSQL_CONTAINER" mysqladmin ping -uroot -p"$MYSQL_ROOT_PASS" --silent 2>/dev/null; do sleep 2 done ``` The dump operation uses the same pattern for both database clients: ```bash docker exec "$MYSQL_CONTAINER" \ mysqldump -uroot -p"$MYSQL_ROOT_PASS" "$SRC" | \ docker exec -i "$MYSQL_CONTAINER" \ mysql -uroot -p"$MYSQL_ROOT_PASS" "$DEST" ``` ### Technical Analysis The root password is concatenated into the `-p` command-line option for `mysql`, `mysqladmin`, and `mysqldump`. Command-line arguments may be exposed through process inspection, diagnostic tooling, audit systems, monitoring agents, error reporting, or command telemetry. The script suppresses standard error for some commands, which hides the MySQL client's password warning but does not remove the credential from the process argument vector. Quoting the variable prevents shell splitting but does not protect the secret from process-level observation. ### Attack Path 1. An operator runs `status`, `wait`, `create-db`, `drop-db`, `dump`, or `list-dbs`. 2. The script starts a MySQL client inside the container with `-p` in its argument list. 3. During the command's lifetime, an attacker or monitoring component with sufficient process-inspection access observes or records the client arguments. 4. The attacker extracts the plaintext root password. 5. The attacker uses the credential wherever the corresponding root account is accepted, including through subsequent administrative execution or an exposed MySQL endpoint. For short-lived commands, exploitation requires time ...[truncated 535 chars]- Remediation
View remediation
`. 2. Create a permission-restricted MySQL option file containing the credentials: ```ini [client] user=root password=REPLACE_WITH_SECRET ``` 3. Mount or provision that file securely inside the container and invoke clients with a protected option file: ```bash mysql --defaults-extra-file=/run/secrets/mysql-client.cnf mysqladmin --defaults-extra-file=/run/secrets/mysql-client.cnf ping --silent mysqldump --defaults-extra-file=/run/secrets/mysql-client.cnf "$SRC" ``` 4. Ensure the option file is readable only by the intended account and is not committed to source control. 5. Prefer Docker secrets or another dedicated secret-management mechanism to provision the option file. 6. Use a dedicated administrative account with only the permissions required by this script rather than the unrestricted root account. 7. Rotate the existing root password if process monitoring, logs, or telemetry may already have captured it. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger phrase "drop database" is highly dangerous because it is generic and maps to a destructive operation. A normal conversational request could unintentionally activate this skill and lead to deletion of a database in a shared development environment, even if the script later prompts for confirmation.
- Content
Shadow Command Trigger
Medium
- Category
- Trigger Abuse
- Confidence
- 70% confidence
- Finding
Shadow Command Trigger: 'start mysql' conflicts with built-in command 'start'
- Content
Shadow Command Trigger
Medium
- Category
- Trigger Abuse
- Confidence
- 70% confidence
- Finding
Shadow Command Trigger: 'stop mysql' conflicts with built-in command 'stop'
- Content
Shadow Command Trigger
Medium
- Category
- Trigger Abuse
- Confidence
- 84% confidence
- Finding
"Create database" conflicts with a generic create-style command and is unsafe because it can activate a privileged, state-changing action from an ambiguous natural-language request. In this skill's context, the command affects a shared MySQL container, so accidental dispatch has real operational consequences beyond a simple UX mismatch.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger phrase "create database" is broad enough to match ordinary user requests that are not clearly intended to invoke this specific skill. Because this skill performs state-changing infrastructure actions, accidental activation could create resources or alter a shared local environment without sufficient user intent validation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger phrase "dump database" is overly generic for a capability that copies database contents between instances. Accidental activation could expose or overwrite data in local development databases, especially in a shared container setup where multiple worktrees or instances rely on the same MySQL service.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Documenting a default root password of "secret" encourages insecure deployments and makes compromise trivial if users retain the default. Although the container is bound to 127.0.0.1, local malware, other local users, or unintended port exposure could leverage predictable credentials to access all databases.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This shell script includes its usage documentation and operational messages in Portuguese only, which imposes a specific language on users without opt-in. The file does not indicate that the skill is intentionally region-specific or provide an alternative language choice, so it conflicts with the language/locale policy criteria.
- Content
Static analysis
No suspicious patterns detected.