sql-explain

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:12 AM UTC
• Version: 1.0.0

Overview

The skill itself is a local SQL helper, but its README includes unsafe installation guidance that can lead users to download and run unverified code and optionally modify a system-wide command path.

Review the README before installing. Prefer using the bundled local files or a verified release, avoid the curl download unless it is replaced with a pinned and checksum-verified source, and do not use sudo just to run the tool unless you intentionally want a system-wide command. Treat generated UPDATE or DELETE SQL as drafts to review before running in a real database.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: README.md:25

Finding

Unverified Remote Payload Retrieval and Subsequent Execution

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 25-29
Vulnerability Type: Mutable remote code download without integrity verification
Risk Level: Medium

Vulnerable Code

bash

pip install sqlparse

# Or download directly
curl -O https://raw.githubusercontent.com/your-repo/main/sql_explain.py
chmod +x sql_explain.py

Technical Analysis

The installation documentation instructs users to retrieve sql_explain.py from a remote, mutable main branch and mark it as executable. The downloaded file is not verified using a cryptographic checksum or signature, and the URL is not pinned to an immutable commit or release artifact.

Consequently, the code users execute can differ from the version included in and reviewed as part of this project. The placeholder repository namespace (your-repo) also does not identify a verified official source. If that namespace is replaced with or resolves to an attacker-controlled source, users may download arbitrary code under the impression that it is the audited SQL utility.

Although the documented command does not immediately invoke the downloaded file, making it executable and presenting it as the installation procedure creates a clear retrieval-and-execution chain when the user subsequently runs the documented CLI commands. Network retrieval is not necessary for the Skill's core functionality because the complete local implementation is already included in the project.

The adjacent pip install sqlparse command also lacks a version constraint and integrity hash. No evidence indicates that the legitimate sqlparse package is malicious, but reproducible, hash-verified dependency installation would reduce supply-chain exposure.

Attack Path

1. An attacker gains control of the referenced repository, branch, account, or replacement namespace.
2. The attacker publishes a modified sql_explain.py containing malicious Python code.
3. A user follows the README and runs the curl command.

...[truncated 1073 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the direct-download instructions when the bundled local file is sufficient.

2. Replace the placeholder repository URL with a verified, project-controlled release location.

3. Reference an immutable release tag or full commit hash rather than the mutable main branch.

4. Publish a SHA-256 checksum or cryptographic signature for each release and require verification before use. For example:

   bash

   curl --fail --proto '=https' --tlsv1.2 -o sql_explain.py \
     https://raw.githubusercontent.com/ORGANIZATION/REPOSITORY/IMMUTABLE_COMMIT/sql_explain.py
   
   echo 'EXPECTED_SHA256  sql_explain.py' | sha256sum --check -
   

5. Prefer a signed package release through a controlled package registry instead of downloading a standalone executable source file.

6. Pin sqlparse to a reviewed version and use a lock file or requirements file with hashes, for example through pip install --require-hashes -r requirements.txt.

7. Clearly state that users should not run the tool with sudo or administrative privileges.

8. Ensure release automation verifies that distributed artifacts exactly match the reviewed source tree.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 94)May include surrounding context.

bash

# 安装（可选）
sudo ln -s $(pwd)/cli.py /usr/local/bin/sql-explain

# 格式化
sql-explain format "SELECT * FROM users"

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger phrase "这个sql怎么写" is broad enough to match ordinary SQL assistance requests, which can cause the skill to activate in situations beyond its intended scope. Overbroad activation can lead to unintended interception of user prompts, confusing routing behavior, and accidental exposure of the skill in contexts where a more appropriate tool or default assistant response should apply.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The top-level documentation frames the skill around explaining, translating, formatting, and syntax-checking SQL, which suggests an analysis/helper tool. However, the nl_to_sql implementation explicitly produces INSERT, UPDATE, and DELETE statements, extending the tool into generating destructive or mutating SQL rather than just explanation or inspection.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code file includes its primary description and operational text in Chinese, and the CLI help/output is also Chinese-first. Under the language/locale policy rule, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The command-line interface prints usage, errors, and results using Chinese-only strings such as '用法' and '未知命令'. Because the skill does not offer language choice or obtain user opt-in, this constitutes a locale/language policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The documentation describes the nl2sql feature specifically as converting Chinese descriptions to SQL and all invocation examples use Chinese phrases. For a general-purpose SQL tool README, this imposes a language expectation without stating that other languages are supported, optional, or intentionally limited to a Chinese-only audience.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The skill heading, role description, and trigger section present bilingual content and language-specific trigger phrases, but the document does not state how the response language is chosen or offer user opt-in. This can create a locale-policy issue if the skill implicitly forces or assumes a language based on its configuration.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The trigger list defines activation cues but provides no invocation constraints, boundaries, or negative examples, making the activation scope ambiguous. This increases the chance of accidental triggering on routine multilingual SQL discussions, which is a routing and control weakness even if it does not directly enable code execution or data access.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code presents its description, usage text, examples, and error/help messages in Chinese only. That can violate language/locale policy when a skill forces a specific language without user opt-in or an explicitly documented locale constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code file contains natural-language docstrings entirely in Chinese, such as the file description and test annotations, with no indication that another language is supported. The policy explicitly calls for flagging language or locale constraints when the skill forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.