ClawHub
Back to skill

Security audit

Db Admin Console Free

Security checks for vulnerabilities and agentic risk

Overview

This database-admin skill is mostly purpose-aligned, but it needs Review because it enables high-impact database changes and an under-described callback URL without strong approval or scoping safeguards.

Install only if you can constrain it to least-privilege database credentials and non-production targets by default. Require the agent to show exact SQL, target host/database/schema, affected objects, and backup or rollback status before any DROP, TRUNCATE, mass DELETE, ALTER, or other irreversible change. Avoid callback_url unless you know exactly what payload is sent and trust the destination.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:146
Finding

Destructive Database Operations Lack Mandatory Execution Safeguards

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 39, 146–147, and 371
Vulnerability Type: Unsafe execution of destructive database operations
Risk Level: Medium

Vulnerable Code Snippet

yaml
tools: ["read", "write", "exec"]
sql
DROP TABLE
TRUNCATE

The skill also states that its core functionality requires command execution capability.

Technical Analysis

The skill requests exec access and explicitly supports irreversible or destructive database operations, including DROP TABLE and TRUNCATE. The only documented protection is a general warning to use these operations cautiously. No enforceable control requires:

  • Explicit confirmation immediately before execution
  • Verification of the target host, database, schema, and environment
  • Production-environment blocking
  • Backup or recovery-point validation
  • A dry run or SQL-only generation mode
  • Use of a least-privilege database account
  • Transactional or migration-based execution where supported

Because the skill is driven by natural-language instructions, an ambiguous request, operator error, or malicious instruction embedded in processed content could cause the Agent to execute destructive SQL through its command-execution capability.

Attack Path

  1. The Agent loads the skill with exec access.
  2. Database credentials are made available through environment variables.
  3. A user request, copied document, or untrusted task content instructs the Agent to reset, clear, recreate, or remove a database object.
  4. The Agent interprets the instruction as authorization to issue DROP TABLE or TRUNCATE.
  5. The Agent invokes a database client through exec and connects using the available credentials.
  6. The destructive statement executes without a mandatory approval gate, target verification, or backup check.
  7. Data or schema objects are permanently removed within the permissions of the configured data ...[truncated 720 chars]
Remediation
View remediation

Remediation Suggestions

  1. Default to generating SQL for review rather than executing it.
  2. Require explicit, operation-specific confirmation immediately before every destructive command.
  3. Display the exact SQL and the resolved host, port, database, schema, and affected objects before requesting confirmation.
  4. Reject implicit confirmation inherited from an earlier message or included in untrusted task content.
  5. Block destructive operations against production targets by default and require a separate, auditable override.
  6. Require verification of a recent recoverable backup or snapshot before execution.
  7. Use dedicated least-privilege accounts that cannot drop or truncate objects unless the task specifically requires those permissions.
  8. Add allowlists for permitted databases, schemas, and operation types.
  9. Prefer reviewed migration tooling and reversible changes where possible.
  10. Record the approved SQL, target identity, approving user, execution time, and result in an audit log without exposing credentials.
  11. Abort if the target environment cannot be identified reliably or if the estimated affected scope differs from the approved scope.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly supports destructive operations such as DROP, TRUNCATE, and other maintenance actions, but does not require a clear confirmation or safety interlock before executing irreversible changes. In a database-admin context with exec and write capabilities, accidental or manipulated invocation could lead to permanent data loss or service disruption.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill defines a callback_url input for asynchronous completion notifications, creating an outbound network channel that is not necessary for the core database-admin use cases described elsewhere. In a skill that also has read, write, and exec, this expands the attack surface for data exfiltration or SSRF-like behavior, especially if execution results or database-derived data are sent to arbitrary user-supplied URLs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The documented callback_url feature introduces outbound transmission but does not warn users that results, metadata, or operational details may be sent off-system. In a database administration skill, this omission is significant because database outputs can contain sensitive records, schema details, or environment information that should not be sent externally without explicit notice and consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The skill name, summary, instructions, examples, and outputs are written entirely in Chinese, with no indication that other languages are supported or that the user may choose their preferred language. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation unless justified or optional.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The error-handling guidance tells the agent to execute generic ping commands for network diagnostics, which exceeds the narrowly described database-admin workflow. Because the skill has exec capability, normalizing arbitrary shell-level network troubleshooting can be abused to probe hosts or perform unintended network activity beyond database management.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.