ClawHub
Back to skill

Security audit

sql-explain

Security checks for vulnerabilities and agentic risk

Overview

This looks like a local SQL helper, but its installation instructions include an unverified remote download and an optional system-wide sudo symlink that users should review carefully.

Install from the reviewed package contents rather than the README's raw curl command, avoid the sudo system-wide symlink unless you specifically need it, and review any generated INSERT, UPDATE, or DELETE SQL before running it against a real database.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning
Location
README.md:23
Finding
Unverified Mutable Remote Payload Download and Execution<![CDATA[ ## Vulnerability Details **File Location**: `README.md`, lines 23–30 **Vulnerability Type**: Remote payload retrieval from an unpinned source **Risk Level**: Medium ### Vulnerable Code ```bash ## Installation pip install sqlparse # Or download directly curl -O https://raw.githubusercontent.com/your-repo/main/sql_explain.py chmod +x sql_explain.py ``` ### Technical Analysis The documented alternative installation procedure downloads a Python executable from the mutable `main` branch of an external GitHub repository and marks it as executable. The URL uses the placeholder repository owner `your-repo` and does not identify a reviewed release, immutable commit, checksum, or cryptographic signature. The effective code executed by a user can therefore differ from the code included in the audited project. HTTPS protects the download in transit but does not guarantee that the repository owner, repository contents, or mutable branch remain trustworthy. Remote retrieval is not required for the Skill's declared local SQL analysis functionality. It also conflicts with the documentation's assertion that the tool does not require network access. ### Attack Path 1. A user follows the alternative installation instructions in `README.md`. 2. The user replaces or otherwise resolves the placeholder repository URL, or the documentation is later updated to reference an attacker-controlled repository. 3. An attacker controlling the repository, account, or mutable `main` branch replaces `sql_explain.py` with malicious Python code. 4. `curl` downloads the modified payload without integrity or authenticity verification. 5. The user marks the downloaded payload executable and subsequently invokes it as documented. 6. The payload executes with all privileges of that user. ### Impact Assessment Successful exploitation permits arbitrary code execution under the installing user's account. The payload could access files available to that account, steal credentials or ...[truncated 468 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Remove the direct `curl` installation path and distribute the utility through a trusted package registry or signed release process. 2. If direct downloads must remain supported: - Replace the placeholder repository with the official project repository. - Reference an immutable commit hash or versioned release asset rather than `main`. - Publish a SHA-256 checksum through an independently authenticated channel. - Require users to verify the checksum before execution. - Prefer cryptographically signed release artifacts and document signature verification. 3. Pin `sqlparse` and test dependencies to reviewed versions, ideally using a lock file or hash-verified requirements file. 4. Avoid instructing users to mark downloaded source files executable when invoking them explicitly with Python is sufficient. 5. Recommend user-local installation, such as `~/.local/bin`, rather than a system-wide `sudo` symlink unless system-wide access is explicitly required. 6. Update the no-network claim to distinguish normal runtime behavior from installation-time downloads. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
```bash
# 安装（可选）
sudo ln -s $(pwd)/cli.py /usr/local/bin/sql-explain

# 格式化
sql-explain format "SELECT * FROM users"
Confidence
70% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The trigger phrases are broad and overlap with ordinary developer requests such as asking how to write or explain SQL. This can cause the skill to activate unintentionally in contexts where the user did not explicitly request this tool, potentially overriding other safeguards or routing sensitive database-related prompts into SQL generation/analysis behavior.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
This code presents its primary documentation and command help text in Chinese, and there is no indication that the skill is region-specific or that users can opt into another language. The stated policy requires flagging language or locale constraints when a specific language is forced without user choice or justification.

Intent-Code Divergence

Medium
Confidence
92% confidence
Finding
The module docstring describes support for EXPLAIN parsing, natural-language-to-SQL, formatting, and syntax checking, but the overall framing ('SQL Query Explain / SQL解释器') suggests an analysis-oriented tool. In contrast, nl_to_sql explicitly produces INSERT, UPDATE, and DELETE statements, which introduce write-oriented behavior not implied by the explanatory/parser framing.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The natural-language-to-SQL feature generates UPDATE and DELETE statements from loose user descriptions without any warning, safety gating, or confirmation. In an agent or automation context, this can turn ambiguous language into destructive SQL that may be executed downstream, causing unintended data modification or deletion.

Natural-Language Policy Violations

Low
Confidence
80% confidence
Finding
The module description and user-facing strings are predominantly in Chinese, including help text and analysis output, with no indication that users can opt into another language. This can violate language/locale policy when a skill imposes a specific language without user choice or documented justification.

Natural-Language Policy Violations

Low
Confidence
87% confidence
Finding
The module docstring is written entirely in Chinese, and many test descriptions and expected outputs throughout the file are also Chinese-only. This indicates a language-specific skill/test experience without any accompanying note that users may choose another language, which can conflict with an organizational language/locale choice policy.

Static analysis

No suspicious patterns detected.