TencentDB DatabaseClaw Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:30 AM UTC
• Version: 1.0.1

Overview

The skill is a coherent TencentDB DatabaseClaw chat client, but it asks users to pass long-lived Tencent Cloud credentials on the command line and can send database-related prompts to a remote service without an added warning or confirmation.

Review before installing if you will use this with real Tencent Cloud credentials or production databases. Prefer least-privilege, short-lived credentials, avoid putting secrets directly in command-line arguments, use the documented --no-session option if console-visible sessions are not desired, and avoid sending sensitive data in prompts unless that is intended for the DatabaseClaw service.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/chat.py:357

Finding

Tencent Cloud credentials exposed through command-line arguments

Content

View full analysis

Vulnerability Details

File Location: scripts/chat.py:357-358
Vulnerability Type: Sensitive credential exposure through process arguments
Risk Level: Medium

The documented usage in SKILL.md:68-69, SKILL.md:75-76, and SKILL.md:87-88 instructs users to supply the same credentials through command-line options.

python

p.add_argument("--secret-id", default="", help="TencentCloud SecretId")
p.add_argument("--secret-key", default="", help="TencentCloud SecretKey")

A representative documented invocation is:

bash

python3 scripts/chat.py --instance-id $INSTANCE_ID --secret-id $SECRET_ID --secret-key $SECRET_KEY \
  --message "hello"

Technical Analysis

The client accepts long-lived Tencent Cloud credentials directly through command-line arguments. After shell variable expansion, the actual credential values become part of the process argument vector.

Depending on the operating system and execution environment, command-line arguments can be exposed through process inspection facilities, monitoring agents, diagnostic tooling, command auditing, job runners, or shell-history practices. Although the secret key is used locally to derive a TC3 signature and is not directly transmitted to Tencent Cloud, accepting it through the command line unnecessarily increases its local exposure.

The network authentication itself is consistent with the declared functionality: requests are signed locally and sent over HTTPS to the documented Tencent Cloud endpoints. The weakness is specifically the credential input mechanism.

Attack Path

1. A user follows the documented command and supplies --secret-id and --secret-key, directly or through expanded shell variables.
2. The shell places the expanded credential values in the process argument vector.
3. A local user, monitoring service, CI/CD log collector, diagnostic utility, or other component capable of observing process commands records or reads ...[truncated 1075 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove command-line options for secret values, or retain them only as a deprecated fallback accompanied by a prominent warning.
2. Load credentials from a supported Tencent Cloud credential provider, protected environment variables, or a credentials file with restrictive filesystem permissions.
3. For interactive execution, use getpass.getpass() so the secret is not echoed or placed in the process argument vector.
4. Update all examples in SKILL.md to avoid passing secrets through --secret-id and --secret-key.
5. Recommend short-lived credentials or role-based credentials rather than long-lived access keys.
6. Apply least-privilege IAM policies so credentials used by this client can invoke only the required DatabaseClaw actions and resources.
7. Ensure exception messages and verbose output never include credentials or complete authorization headers.
8. Rotate any credentials that may already have been exposed through process logs, shell history, CI/CD logs, or monitoring systems.

T08 · Insecure Dependencies

Note

• Location: references/python-integration.md:5

Finding

Unpinned third-party dependency installation instruction

Content

View full analysis

Vulnerability Details

File Location: references/python-integration.md:5
Vulnerability Type: Mutable third-party dependency resolution
Risk Level: Low

bash

pip install requests

Technical Analysis

The integration reference instructs users to install requests without specifying a reviewed version, hashes, or a trusted package index. Consequently, the installed artifact depends on the package index and dependency resolution state at installation time.

This does not demonstrate that the current requests package is malicious. The issue is that the instruction does not provide reproducible or integrity-verified dependency resolution. A future compromised release, compromised package index, malicious index mirror, or altered transitive dependency could introduce code that was not part of the audited Skill.

The standalone scripts/chat.py client uses only the Python standard library, so this third-party dependency is not necessary for the primary CLI functionality. It is required only by the optional integration example.

Attack Path

1. A user follows the integration reference and executes pip install requests.
2. pip queries the active package index or a configured mirror and resolves the latest compatible package and transitive dependencies.
3. An attacker has compromised the selected package release, a transitive dependency, the configured index, or the distribution path.
4. pip downloads and installs the attacker-controlled artifact without checking project-provided hashes.
5. Malicious package installation or runtime code executes with the privileges of the user or automation account running the command.
6. The malicious code can access data and credentials available in that environment, including Tencent Cloud credentials subsequently used by the integration.

Exploitation depends on compromise or malicious control of the resolved dependency source; no such active compromise was id ...[truncated 542 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin requests and its transitive dependencies to reviewed versions in a lock file or requirements file.
2. Require hashes by using a command such as pip install --require-hashes -r requirements.txt.
3. Document the trusted package index and avoid untrusted or implicitly configured mirrors.
4. Use an isolated virtual environment rather than installing into a system-wide Python environment.
5. Add automated dependency vulnerability and integrity scanning to the release process.
6. Prefer the existing standard-library client when the requests integration is not needed.
7. Periodically review and update pinned versions through a controlled dependency-update process.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: tencentdb-databaseclaw
description: "This skill should be used when an AI agent or automated system needs to send messages to a TencentDB DatabaseClaw instance and receive streaming responses. It provides a verified Python client (scripts/chat.py) and complete TC3-HMAC-SHA256 signing reference for the CreateChatCompletion SSE API. Trigger on keywords: DatabaseClaw, DBClaw, clawins-, TDAI chat, agent-to-agent database query."
---

# TencentDB-DatabaseClaw

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md

# TencentDB-DatabaseClaw

Send messages to a DatabaseClaw instance via the `CreateChatCompletion` SSE API and receive streaming Agent responses.

## When to Use

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill describes networked and agent-style capabilities but does not declare any explicit tool scope or permission boundaries. In an agent environment, this can enable broader-than-expected outbound communication and integration behavior, increasing the chance of misuse or unsafe invocation paths.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/python-integration.md (reported line 118)May include surrounding context.

python

import requests

resp = requests.post(
    "https://tdai.ai.tencentcloudapi.com/",
    headers=headers,
    data=body.encode("utf-8"),

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The chat() path performs HTTP POST requests containing InputContent and InstanceId to external or internal services, but the code does not display any disclosure or confirmation before transmitting user-provided content. Although the module docstring describes API usage, it does not warn users that entered messages are sent to a remote service and may be visible in a console session.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The natural-language examples shown to users use Chinese query text as the only illustrated interaction, which implicitly biases the skill toward a specific language. There is no accompanying note that other languages are supported or that Chinese is required for a justified regional reason.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.