T03 · Remote Payload Retrieval and Execution
Warning
- Location
README.md:23- Finding
Unverified Mutable Remote Payload Download and Execution
- Content
View full analysis
- Remediation
View remediation
Security audit
sql-explain
Security checks for vulnerabilities and agentic risk
Overview
This looks like a local SQL helper, but its installation instructions include an unverified remote download and an optional system-wide sudo symlink that users should review carefully.
Install from the reviewed package contents rather than the README's raw curl command, avoid the sudo system-wide symlink unless you specifically need it, and review any generated INSERT, UPDATE, or DELETE SQL before running it against a real database.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # 安装（可选） sudo ln -s $(pwd)/cli.py /usr/local/bin/sql-explain # 格式化 sql-explain format "SELECT * FROM users"
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The trigger phrases are broad and overlap with ordinary developer requests such as asking how to write or explain SQL. This can cause the skill to activate unintentionally in contexts where the user did not explicitly request this tool, potentially overriding other safeguards or routing sensitive database-related prompts into SQL generation/analysis behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code presents its primary documentation and command help text in Chinese, and there is no indication that the skill is region-specific or that users can opt into another language. The stated policy requires flagging language or locale constraints when a specific language is forced without user choice or justification.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The module docstring describes support for EXPLAIN parsing, natural-language-to-SQL, formatting, and syntax checking, but the overall framing ('SQL Query Explain / SQL解释器') suggests an analysis-oriented tool. In contrast, nl_to_sql explicitly produces INSERT, UPDATE, and DELETE statements, which introduce write-oriented behavior not implied by the explanatory/parser framing.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The natural-language-to-SQL feature generates UPDATE and DELETE statements from loose user descriptions without any warning, safety gating, or confirmation. In an agent or automation context, this can turn ambiguous language into destructive SQL that may be executed downstream, causing unintended data modification or deletion.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The module description and user-facing strings are predominantly in Chinese, including help text and analysis output, with no indication that users can opt into another language. This can violate language/locale policy when a skill imposes a specific language without user choice or documented justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The module docstring is written entirely in Chinese, and many test descriptions and expected outputs throughout the file are also Chinese-only. This indicates a language-specific skill/test experience without any accompanying note that users may choose another language, which can conflict with an organizational language/locale choice policy.
- Content