SQL Data Analyst

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 10:52 PM UTC
• Version: 1.0.0

Overview

This is a disclosed database-analysis skill, but users should know it can run read queries and store imported data, schemas, saved queries, and query logs locally.

Install only if you are comfortable giving the agent access to the databases or CSVs you choose. Review generated SQL before use on sensitive systems, disable or avoid auto-execute if available, and periodically clear local schema caches, imported tables, saved queries, exports, and query logs if they may contain confidential information.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The README makes a strong safety claim ('Safe by default' and 'Read-only queries only') while elsewhere advertising CSV import and saved query shortcuts, both of which necessarily write data or configuration state. This creates a misleading trust boundary: users may rely on the skill as non-mutating when it can perform local state changes, increasing the chance of unsafe use or over-granting permissions.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

2. Map to the correct tables/columns
3. Generate the SQL query
4. Show the query with explanation
5. Ask to execute (or auto-execute if user has set that preference)

**Example:**
> User: "What were our top 10 customers by revenue last quarter?"

• Confidence: 85% confidence
• Finding: Allowing auto-execution based on a user preference introduces autonomous action in a high-impact context involving databases, reducing the review barrier before queries run. Although the skill claims read-only defaults, automatically executed queries can still expose sensitive data, trigger expensive scans, or execute unsafe statements if query classification or preference handling is flawed.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: Logging all executed queries to ./data/query-log.json without a clear retention warning can capture sensitive query text indefinitely, including searches for specific customers, PII-bearing columns, or confidential investigation topics. Query logs often become a secondary leakage source because they preserve intent and access patterns even when results are not stored.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

"settings": {
    "default_connection": "local",
    "default_limit": 1000,
    "auto_execute_select": true,
    "require_confirmation_for_writes": true,
    "show_query_before_execute": true,
    "log_queries": true

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Vague Triggers

Low

• Confidence: 90% confidence
• Finding: This markdown file describes activation through general natural-language requests like "Compare this month vs last month" and "Explain the query" without defining a specific trigger scope, exclusions, or negative examples. Those phrases overlap with ordinary conversation and could cause unintended invocation if used as the skill's activation guidance.

Missing User Warnings

Low

• Confidence: 95% confidence
• Finding: The skill explicitly instructs caching discovered schema metadata in ./data/schemas/ but does not require user notice or consent before persisting information derived from connected databases. While schema data is less sensitive than row data, table names, column names, and relationships can still reveal internal business structure, regulated datasets, or security-relevant architecture.

Missing User Warnings

Low

• Confidence: 98% confidence
• Finding: The CSV import flow states that uploaded file contents will be imported into ./data/analyst.db, but it does not clearly disclose that the source data will be copied and retained locally after analysis. Users may assume transient processing, and imported CSVs can contain sensitive personal, financial, or proprietary data.

Missing User Warnings

Low

• Confidence: 94% confidence
• Finding: Persisting saved queries in ./config/saved-queries.json can retain sensitive SQL text, including business logic, filters, table names, and analyst workflows, without warning the user. Even if credentials are excluded, stored queries may still expose confidential operational details to other local users or future processes.

Static analysis

No suspicious patterns detected.