Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Mysql Skill 1.0.0 (3)

v1.0.0

MySQL 数据库管理技能。通过自然语言查询、管理 MySQL 数据库,支持 SELECT/INSERT/UPDATE/DELETE、表管理、备份恢复等操作。当用户提到 MySQL、数据库查询、建表、数据备份时使用此技能。

0· 73·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for ding-renew/mysql-skill-1-0-0-3.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Mysql Skill 1.0.0 (3)" (ding-renew/mysql-skill-1-0-0-3) from ClawHub.
Skill page: https://clawhub.ai/ding-renew/mysql-skill-1-0-0-3
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install mysql-skill-1-0-0-3

ClawHub CLI

Package manager switcher

npx clawhub@latest install mysql-skill-1-0-0-3
Security Scan
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill is clearly intended for MySQL DB management and the actions/instructions (SQL generation, mysqldump, mysql commands) are coherent with that purpose. package.json also lists mysql and mysqldump as required binaries, which is expected for the described functionality. However, registry metadata shown earlier lists no required binaries while package.json does — an inconsistency in declared capabilities.
!
Instruction Scope
SKILL.md instructs use of ~/.my.cnf or environment variables (MYSQL_HOST, MYSQL_USER, MYSQL_PASSWORD, MYSQL_DATABASE) to provide credentials, but the skill's declared required env vars are empty. The runtime instructions therefore reference credentials/paths that are not declared in the skill manifest. While the instructions don't explicitly tell the agent to read arbitrary unrelated files, they do instruct running mysql/mysqldump commands which will consume local credentials — this mismatch should be clarified.
Install Mechanism
No install spec was reported at the top-level registry view, but package.json includes an openclaw.install entry with apt/brew commands to install mysql-client. Those commands use standard package managers (low risk). The only concern is the manifest inconsistency: install instructions exist inside package.json but were not reflected in the provided registry 'Install specifications' summary.
Credentials
The skill reasonably needs database credentials to operate, and SKILL.md recommends storing them in ~/.my.cnf or env vars. It does not request unrelated credentials. The proportionate concern is that required credentials are not declared in the skill metadata (no primaryEnv, no requires.env), so an agent or integrator may not be aware the skill will rely on secrets in the environment or config files.
Persistence & Privilege
The skill does not request permanent presence (always: false) and uses default model invocation behavior. There is no evidence it modifies other skills or system-wide agent settings.
What to consider before installing
This skill appears to do what it claims (manage MySQL via natural language), but the package/manifest is inconsistent in ways that matter: package.json lists mysql/mysqldump and install commands while the registry summary did not declare them, and SKILL.md expects credentials via ~/.my.cnf or environment variables although no env vars are declared. Before installing/use: (1) verify the skill publisher and repository (the package.json repo/homepage point to external URLs), (2) treat DB credentials carefully — create a least-privilege user for this skill and avoid using root or full-admin accounts, (3) prefer to install the MySQL client yourself (run the apt/brew commands manually) rather than relying on the skill to do it automatically, (4) confirm where credentials will be stored/used (do not expose them in shared shells or logs), and (5) consider requesting the skill author to correct manifest metadata so required binaries and env vars are declared consistently. If you need higher assurance, review the upstream repository (github URL in package.json) or ask the author for a signed/verified release before granting access to any production database.

Like a lobster shell, security has layers — review code before you run it.

latestvk97agrz31z1z9cdk2mdvp2rfmh84thk4
73downloads
0stars
1versions
Updated 2w ago
v1.0.0
MIT-0

MySQL Skill - 对话式数据库管理

通过自然语言,轻松管理 MySQL 数据库,无需手写 SQL!


🎯 功能特点

核心能力

  • 🔍 智能查询 - 用自然语言描述需求,自动生成 SQL
  • 📊 数据分析 - 快速统计、聚合、分组查询
  • 🛠️ 表管理 - 建表、修改表结构、索引管理
  • 💾 备份恢复 - 数据库/表级备份和恢复
  • 🔧 优化建议 - 慢查询分析、索引优化建议

📋 使用场景

查询场景

  • "查询昨天注册的用户"
  • "统计每个部门的员工数量"
  • "找出销售额前十的产品"
  • "查询最近一周的订单,按时间倒序"

数据操作

  • "给用户表中添加一个 phone 字段"
  • "把所有状态为 pending 的订单改为 confirmed"
  • "删除三个月前的日志记录"

备份场景

  • "备份数据库"
  • "恢复昨天下午的备份"
  • "导出用户表的数据"

🔧 前置条件

1. 安装 MySQL 客户端

Ubuntu/Debian:

sudo apt update
sudo apt install mysql-client

macOS:

brew install mysql-client

Windows: 下载并安装 MySQL 官方客户端工具

2. 配置数据库连接

创建配置文件 ~/.my.cnf:

[client]
host = localhost
user = your_username
password = your_password
database = your_database

或通过环境变量:

export MYSQL_HOST=localhost
export MYSQL_USER=your_username
export MYSQL_PASSWORD=your_password
export MYSQL_DATABASE=your_database

💻 常用操作

查询数据

自然语言描述:

查询销量最高的 5 个产品

AI 生成的 SQL:

SELECT product_name, SUM(quantity) as total_sales
FROM orders
GROUP BY product_name
ORDER BY total_sales DESC
LIMIT 5;

创建表

自然语言描述:

创建一个用户表,包含 id、用户名、邮箱、注册时间

AI 生成的 SQL:

CREATE TABLE users (
    id INT AUTO_INCREMENT PRIMARY KEY,
    username VARCHAR(50) NOT NULL,
    email VARCHAR(100) NOT NULL UNIQUE,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    INDEX idx_username (username)
);

数据备份

备份数据库:

mysqldump --single-transaction --quick --lock-tables=false \
    your_database > backup_$(date +%Y%m%d_%H%M%S).sql

备份单个表:

mysqldump your_database table_name > table_backup.sql

恢复数据:

mysql your_database < backup_file.sql

🔍 高级功能

慢查询分析

  1. 开启慢查询日志:
SET GLOBAL slow_query_log = 'ON';
SET GLOBAL long_query_time = 2;
SET GLOBAL slow_query_log_file = '/var/log/mysql/slow.log';
  1. 分析慢查询:
mysqldumpslow /var/log/mysql/slow.log

索引优化建议

查看表的索引使用情况:

SELECT 
    TABLE_NAME, INDEX_NAME, CARDINALITY
FROM information_schema.STATISTICS
WHERE TABLE_SCHEMA = 'your_database'
ORDER BY TABLE_NAME, INDEX_NAME;

数据库性能检查

查看数据库状态:

SHOW STATUS LIKE 'Threads_connected';
SHOW STATUS LIKE 'Questions';
SHOW STATUS LIKE 'Uptime';

⚠️ 注意事项

安全建议

  1. 使用环境变量存储密码,不要在命令行中明文显示
  2. 最小权限原则 - 使用只读用户进行查询操作
  3. 生产环境谨慎操作 - 写操作前先备份数据
  4. `LIMIT 子句 - 大数据量查询一定要加 LIMIT

性能优化

  1. 为常用查询字段添加索引
  2. 避免 SELECT *,只查询需要的字段
  3. 大量数据操作使用事务
  4. 定期清理过期数据

🎓 示例对话

示例 1:查询分析

用户: "帮我看看这个月的销售额分布"

AI: "好的,我来查询这个月每天的销售额。"

SELECT 
    DATE(order_date) as date,
    SUM(amount) as daily_sales
FROM orders
WHERE order_date >= DATE_FORMAT(NOW(), '%Y-%m-01')
GROUP BY DATE(order_date)
ORDER BY date;

示例 2:表结构修改

用户: "给订单表加一个优惠券字段"

AI: "好的,正在添加字段..."

ALTER TABLE orders
ADD COLUMN coupon_code VARCHAR(50) NULL
AFTER discount_amount;

示例 3:数据备份

用户: "备份一下数据库"

AI: "正在备份数据库到 backup_20260323.sql..."

mysqldump --single-transaction --quick your_database > backup_20260323.sql

🛠️ 故障排查

常见错误

1. ERROR 1045 (28000): Access denied

  • 检查用户名和密码
  • 确认用户有权限访问该数据库

2. ERROR 2002 (HY000): Can't connect to MySQL server

  • 检查 MySQL 服务是否运行
  • 确认主机名和端口配置正确

3. Query took too long

  • 检查是否添加了合适的索引
  • 使用 EXPLAIN 分析查询计划
  • 考虑添加 LIMIT 限制结果数量

📚 参考资料


开始使用: 直接告诉我你想查询什么,我会自动生成 SQL!🚀

Comments

Loading comments...