Duckdb Cli

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 6:22 AM UTC
• Version: 1.0.0

Overview

This is a straightforward DuckDB helper skill; it documents normal DuckDB file and database operations without hidden code or deceptive behavior.

Install only if you want Claude to help with DuckDB CLI work. Review commands before running them, especially ones that write output files, modify .duckdb databases, read local datasets, change ~/.duckdbrc, or open an external editor.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Skill Enumeration

Medium

• Category: Agent Snooping

Content

Copy `SKILL.md` to your Claude Code skills directory:

```bash
mkdir -p ~/.claude/skills/duckdb
cp SKILL.md ~/.claude/skills/duckdb/
```

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Session Persistence

Medium

• Category: Rogue Agent

Content

Copy `SKILL.md` to your Claude Code skills directory:

```bash
mkdir -p ~/.claude/skills/duckdb
cp SKILL.md ~/.claude/skills/duckdb/
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The manifest description says the skill triggers on generic terms including "sql", "query", and "data analysis". These phrases overlap with common user requests across many contexts and are not narrowly scoped to DuckDB CLI usage, increasing the chance of accidental activation.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly documents commands that write files and modify databases, but it does not warn users that these operations are state-changing or potentially destructive. In an agent context, this increases the chance that a model may suggest or execute a write operation on user data without clear confirmation, leading to accidental overwrite, corruption, or unintended persistence.

Session Persistence

Medium

• Category: Rogue Agent

Content

# Pipe to another command
duckdb -csv -c "SELECT * FROM 'data.parquet'" | head -20

# Write to stdout
duckdb -c "COPY (SELECT * FROM 'data.csv') TO '/dev/stdout' (FORMAT CSV)"
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Vague Triggers

Low

• Confidence: 83% confidence
• Finding: This markdown file describes example prompts such as "Convert this CSV to Parquet" and "Show me statistics for sales.csv" without clarifying whether they are merely examples after explicit `/duckdb` activation or also implicit triggers. Because these are common data-assistance requests, the README lacks negative examples or scope boundaries that would prevent unintended invocation in broader contexts.

Natural-Language Policy Violations

Low

• Confidence: 72% confidence
• Finding: The skill name `duckdb-en` suggests an English-only variant, but the document does not explain the locale constraint or offer language choice. If this naming reflects enforced English responses or usage, it may violate language/locale policy expectations without explicit opt-in or justification.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: The markdown instructs users to open queries in an external editor and explains that the editor is chosen from environment variables. This can cause query contents to be opened in external programs, but the skill description provides no warning about that behavior or the need to trust the configured editor.

Static analysis

No suspicious patterns detected.