Sql Audit

SQL 语法与安全审核，它将真正执行，并返回执行的数据结果

Security Scan

The skill largely matches an SQL-audit-and-execute purpose, but there are multiple mismatches and undisclosed environment/secret handling that make its actual behavior unclear and potentially risky.

Purpose & Capability

The skill's stated purpose is to audit and actually execute SQL against StarRocks/Doris. Executing SQL requires database credentials — which the code uses — so that part is coherent. However the SKILL.md lists DB_HOST/DB_PORT/DB_USER/DB_PASSWORD/DB_NAME as .env keys while the runtime (index.js / python) prefers a single DB_DSN environment variable or an explicit db_dsn input. The registry metadata also declared no required env vars, which is inconsistent with the code and README.

Instruction Scope

The instructions and implementation perform real SQL execution (expected) but also read configuration from a parent .env file (index.js loads ../.env) which can expose unrelated secrets to the skill. The skill may call an external LLM (Gemini) for fallback candidate generation using GEMINI_API_* envs. The code will execute arbitrary SQL provided to it (or from candidates), so callers must ensure those queries are safe and that the DB credentials have minimal privileges.

Install Mechanism

No install spec is provided (lower install risk), but the package includes two code files (index.js and sql_audit.py) and has runtime Python dependencies (pymysql, httpx) that are not documented in a package install step. The absence of declared dependency installation means runtime failures or implicit dependency pulls are possible.

Credentials

The skill requires database credentials and optionally Gemini API keys/tokens to function, but the registry metadata declared no required env vars. Worse, index.js loads ../.env (project root) into process.env, potentially exposing unrelated secrets stored there to the skill and to the spawned Python process. The discrepancy between documented .env keys and actual code (DB_HOST vs DB_DSN) is confusing and risky.

Persistence & Privilege

The skill does not request always:true and does not modify other skills' configs. It runs as an invoked skill (normal privilege). There is no evidence it persists beyond its execution footprint.

What to consider before installing

This skill will actually run SQL against whatever database credentials you provide and may call an external LLM (Gemini) if configured. Before installing or running it: - Don't supply high-privilege DB credentials. Create and use a dedicated, read-only DB user limited to the minimal schemas/tables needed. - Verify how you will provide credentials: the code expects DB_DSN or an explicit db_dsn input, but SKILL.md lists DB_HOST/DB_USER/etc — fix this mismatch and test in a safe environment. - Be aware index.js loads ../.env (the parent .env). That can leak other project secrets into the skill; store DB/GEMINI credentials in a separate, minimal .env for the skill or avoid using a project-wide .env. - The skill may make outbound HTTP calls (Gemini) using GEMINI_API_URL/GEMINI_API_KEY/GEMINI_TOKEN. Only provide tokens that are scoped and revocable. - Review the included sql_audit.py code (especially the parts that build and send LLM requests and error handling) before use. Run the skill in an isolated environment or staging DB first. - If you cannot review the code or control the DB credentials and network egress, do not install or run this skill. I rated this 'suspicious' (not 'malicious') because many behaviors are reasonable for an SQL execution/audit tool, but the undocumented env usage, .env loading from the project root, and mismatch between docs and runtime make it unclear and potentially dangerous without careful configuration and review.

Skill: sql_audit

• Description: SQL 语法与安全审核 + 真实执行，返回查询数据结果。

• Inputs: [sql_output]（从 skills/.workflow/sql_output.json 读取）

• Outputs: [data, row_count, success]（写入 skills/.workflow/audit_output.json）

• ID: sql_audit

• Role: 质量与安全哨兵 + 执行引擎

• 功能描述：在 SQL 执行前进行静态扫描，确保语法正确；通过连接真实 StarRocks/Doris 执行 SQL 并返回结果。

• 输入参数（来自 sql_output.json）：

  • sql (string): 主候选 SQL
  • sql_candidates (list): 多候选 SQL（重试用）
  • query (string): 用户原始问题
  • indicator_metric (list): 指标维度（重试时用于生成简化候选）

• 输出结果：

  • success (boolean): 执行是否成功。
  • data (list): 查询结果行（每行为 dict）。
  • row_count (int): 结果行数。
  • need_retry (boolean): 若结果为空，建议重新生成 SQL。
  • new_indicator_metrics (list): 简化后的候选指标（供重试时传给 sql_generator）。

• 拦截规则：拦截全表扫描（无 Where 条件）；拦截写操作；拦截跨库非法关联。

依赖（通过 .env 配置）

服务	.env 配置键
StarRocks/Doris	DB_HOST / DB_PORT（默认 9030）/ DB_USER / DB_PASSWORD / DB_NAME
Gemini（兜底候选生成）	GEMINI_API_URL / GEMINI_API_KEY / GEMINI_TOKEN

独立运行说明

# 前置：先运行前四步
python ../rewrite-question/rewrite_question.py --query "今天汉河店的成交额"
python ../recognize-intent/recognize_intent.py
python ../mult-call/multi_call.py
python ../sql-generator/sql_generator.py

# 运行 SQL 审核执行（从 .workflow/sql_output.json 自动读取）
python sql_audit.py

# 带清理（清除本步输出）
python sql_audit.py --clean

这是整条链路的最后一步，执行完毕后可查看 skills/.workflow/audit_output.json 获得最终结果。