ClawHub
Back to skill

Security audit

数据库管理(免费版)

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward database helper that can create and insert database records, so users should treat it as capable of changing a real database.

Before using this skill, confirm the target database and credentials, review generated SQL before execution, and prefer a test database or backup when creating tables, indexes, or inserting data.

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill advertises and demonstrates live data-modifying SQL operations such as CREATE TABLE, INSERT, BEGIN/COMMIT, and index creation, but it does not clearly warn users that invoking the skill may alter persistent database state. In an agent setting with exec/read/write tools available, this can lead to unintended schema changes or data writes if users assume the skill is informational or read-only.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.