TiDB X

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 4:20 AM UTC
• Version: 1.0.0

Overview

This is a straightforward TiDB X guide, with some ordinary but important cautions around verifying the install source and protecting generated database credentials.

Before installing, prefer a pinned commit or reviewed copy instead of the raw main-branch URL. When using the quick start, treat tidb-zero.json and MYSQL_PWD as secrets: keep the file private, avoid committing it, delete it when done, and rotate or discard the instance if the response is exposed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:409

Finding

Mutable Remote Skill Installed Without Integrity Verification

Content

View full analysis

mkdir -p ~/.openclaw/skills/tidb-x && curl -so ~/.openclaw/skills/tidb-x/SKILL.md https://raw.githubusercontent.com/siddontang/tidb-x-skill/main/SKILL.md click to copy

— or send this prompt to any AI agent —

Read and learn from this skill file about TiDB X: https://raw.githubusercontent.com/siddontang/tidb-x-skill/main/SKILL.md click to copy

``` ### Technical Analysis The installation instructions download an active agent skill from the mutable `main` branch and place it directly in the user's OpenClaw skill directory. No immutable commit identifier, cryptographic checksum, digital signature, or manual review step is required. Consequently, the content installed by a user may differ from the version examined during this audit. Compromise of the upstream repository, maintainer account, or publ ...[truncated 1693 chars]

Remediation

View remediation

/SKILL.md ``` 2. Publish a trusted SHA-256 digest and verify it before installation: ```bash printf '%s %s\n' '' skill.tmp | sha256sum -c - ``` 3. Move the verified file into the skill directory only after successful validation: ```bash install -m 0600 skill.tmp ~/.openclaw/skills/tidb-x/SKILL.md ``` 4. Use `curl -fL` so HTTP failures cause installation to stop instead of silently writing an error response. 5. Sign releases or release manifests and document signature verification. 6. Require users or agents to review newly downloaded instruction content before loading it. 7. Update every duplicated installation example in `README.md`, `SKILL.md`, and `docs/index.html` so users are not directed back to the mutable URL. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:14

Finding

Database Credentials Persisted in a Plaintext File and Process Environment

Content

View full analysis

Remediation

View remediation

"$response_file" ``` 4. Avoid leaving the API response in the project or current working directory. 5. Unset `MYSQL_PWD` immediately after the database client exits: ```bash MYSQL_PWD="$(jq -r '.instance.connection.password' "$response_file")" \ mysql -u "$(jq -r '.instance.connection.username' "$response_file")" \ -h "$(jq -r '.instance.connection.host' "$response_file")" \ -P 4000 --ssl-mode=REQUIRED ``` This limits the variable to the `mysql` process rather than exporting it to all later child processes. 6. For longer-lived instances, use a protected MySQL login path, operating-system credential store, or dedicated secret manager. 7. Add `tidb-zero.json` and equivalent credential files to `.gitignore` as defense in depth, while retaining secure permissions and cleanup as the primary controls. 8. Rotate or revoke credentials immediately if the response file is accidentally exposed. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (17)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 81% confidence

Finding

The README instructs users or agents to create a persistent local skill directory and fetch executable instruction content directly from a remote raw GitHub URL into it. This creates a supply-chain and persistence risk: a future change to the remote SKILL.md can silently alter agent behavior across sessions, and the persisted file may be auto-loaded by agent frameworks.

Content

Scanner excerpt · README.md (reported line 9)May include surrounding context.

OpenClaw

bash

mkdir -p ~/.openclaw/skills/tidb-x
curl -so ~/.openclaw/skills/tidb-x/SKILL.md https://raw.githubusercontent.com/siddontang/tidb-x-skill/main/SKILL.md

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 10)May include surrounding context.

OpenClaw

bash

mkdir -p ~/.openclaw/skills/tidb-x
curl -so ~/.openclaw/skills/tidb-x/SKILL.md https://raw.githubusercontent.com/siddontang/tidb-x-skill/main/SKILL.md

Other Agents

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 45)May include surrounding context.

OpenClaw

bash

mkdir -p ~/.openclaw/skills/tidb-x
curl -so ~/.openclaw/skills/tidb-x/SKILL.md https://raw.githubusercontent.com/siddontang/tidb-x-skill/main/SKILL.md

Other Agents

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 409)May include surrounding context.

OpenClaw

bash

mkdir -p ~/.openclaw/skills/tidb-x
curl -so ~/.openclaw/skills/tidb-x/SKILL.md https://raw.githubusercontent.com/siddontang/tidb-x-skill/main/SKILL.md

Other Agents

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · docs/index.html (reported line 134)May include surrounding context.

html

### OpenClaw
```bash
mkdir -p ~/.openclaw/skills/tidb-x
curl -so ~/.openclaw/skills/tidb-x/SKILL.md https://raw.githubusercontent.com/siddontang/tidb-x-skill/main/SKILL.md
```

### Other Agents

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 10)May include surrounding context.

OpenClaw

bash

mkdir -p ~/.openclaw/skills/tidb-x
curl -so ~/.openclaw/skills/tidb-x/SKILL.md https://raw.githubusercontent.com/siddontang/tidb-x-skill/main/SKILL.md

Other Agents

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 43)May include surrounding context.

OpenClaw

bash

mkdir -p ~/.openclaw/skills/tidb-x
curl -so ~/.openclaw/skills/tidb-x/SKILL.md https://raw.githubusercontent.com/siddontang/tidb-x-skill/main/SKILL.md

Other Agents

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 45)May include surrounding context.

OpenClaw

bash

mkdir -p ~/.openclaw/skills/tidb-x
curl -so ~/.openclaw/skills/tidb-x/SKILL.md https://raw.githubusercontent.com/siddontang/tidb-x-skill/main/SKILL.md

Other Agents

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 49)May include surrounding context.

OpenClaw

bash

mkdir -p ~/.openclaw/skills/tidb-x
curl -so ~/.openclaw/skills/tidb-x/SKILL.md https://raw.githubusercontent.com/siddontang/tidb-x-skill/main/SKILL.md

Other Agents

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 409)May include surrounding context.

OpenClaw

bash

mkdir -p ~/.openclaw/skills/tidb-x
curl -so ~/.openclaw/skills/tidb-x/SKILL.md https://raw.githubusercontent.com/siddontang/tidb-x-skill/main/SKILL.md

Other Agents

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · docs/index.html (reported line 134)May include surrounding context.

html

### OpenClaw
```bash
mkdir -p ~/.openclaw/skills/tidb-x
curl -so ~/.openclaw/skills/tidb-x/SKILL.md https://raw.githubusercontent.com/siddontang/tidb-x-skill/main/SKILL.md
```

### Other Agents

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · docs/index.html (reported line 139)May include surrounding context.

html

### OpenClaw
```bash
mkdir -p ~/.openclaw/skills/tidb-x
curl -so ~/.openclaw/skills/tidb-x/SKILL.md https://raw.githubusercontent.com/siddontang/tidb-x-skill/main/SKILL.md
```

### Other Agents

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · docs/index.html (reported line 243)May include surrounding context.

html

### OpenClaw
```bash
mkdir -p ~/.openclaw/skills/tidb-x
curl -so ~/.openclaw/skills/tidb-x/SKILL.md https://raw.githubusercontent.com/siddontang/tidb-x-skill/main/SKILL.md
```

### Other Agents

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The quick-start flow provisions a live database instance and writes returned connection details, including username and password, into a local file and shell environment without any warning about secret handling, file permissions, shell history, or cleanup. In an agent context, this increases the chance that ephemeral but valid credentials are logged, exposed to other tools, or later exfiltrated from the workspace.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

The skill instructs users to send a POST request to an external service that returns provisioned database credentials, creating an outbound data flow and trust dependency on a third-party endpoint. In isolation this is expected product behavior, but in an agent skill it is risky because it can trigger unreviewed network actions and establish external resources without clear consent, validation, or warnings about credential sensitivity.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

bash

# Provision (single API call, no auth required)
curl -s -X POST "https://zero.tidbapi.com/v1alpha1/instances" \
  -H "Content-Type: application/json" \
  -d '{"tag":"my-agent"}' | tee tidb-zero.json

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 409)May include surrounding context.

Install This Skill

bash

mkdir -p ~/.openclaw/skills/tidb-x && curl -so ~/.openclaw/skills/tidb-x/SKILL.md https://raw.githubusercontent.com/siddontang/tidb-x-skill/main/SKILL.md

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 78% confidence

Finding

The page encourages users to persistently install a remote skill into ~/.openclaw/skills using curl from a mutable main-branch URL. This creates a supply-chain and persistence risk: if the remote file is later modified or the source account/repo is compromised, users or agents may install unreviewed instructions that remain available across sessions.

Content

Scanner excerpt · docs/index.html (reported line 134)May include surrounding context.

html

<div class="install-box">
      <h3>🤖 Teach your AI agent about TiDB X</h3>
      <div class="code-block" onclick="navigator.clipboard.writeText(this.innerText.replace('click to copy','').trim())">
        mkdir -p ~/.openclaw/skills/tidb-x && curl -so ~/.openclaw/skills/tidb-x/SKILL.md https://raw.githubusercontent.com/siddontang/tidb-x-skill/main/SKILL.md
        <span class="copy-hint">click to copy</span>
      </div>
      <div class="or-divider">— or send this prompt to any AI agent —</div>