Db Schema Designer Free

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:30 AM UTC
• Version: 1.0.0

Overview

This is a SQLite schema-design helper with disclosed local database actions, and I found no hidden payload, exfiltration, or persistence behavior.

Install this only if you want an agent to help design and optionally create local SQLite databases. Confirm before it writes files, runs sqlite3 commands, inserts sample data, or installs Python packages; prefer a sandbox or virtual environment and pinned dependencies for pypdf or pysqlite3.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:325

Finding

Unpinned Third-Party Python Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 325–327
Vulnerability Type: Supply-chain risk from unpinned package installation
Risk Level: Medium

Complete Code Snippet:

markdown

| sqlite3 | Database engine | Required | Bundled with the system or `pip install pysqlite3` |
| LLM API | API | Required | Provided by the Agent platform's built-in LLM |
| pypdf | Python library | Optional | `pip install pypdf` (PDF text extraction) |

Technical Analysis

The Skill directs the Agent to install pysqlite3 and pypdf without fixed versions, cryptographic hashes, a lock file, or an explicitly trusted package index. Consequently, the installed artifacts depend on package-index state at execution time rather than on dependencies reviewed with this Skill.

Python package installation may execute package-controlled build or installation logic. A compromised upstream release, dependency compromise, index redirection, or malicious package selected through an unsafe package source could therefore cause arbitrary code execution during installation. The audit found no evidence that the named packages are currently malicious; the confirmed issue is the unsafe, non-reproducible installation practice.

Attack Path

1. A user requests SQLite support that is unavailable locally or requests PDF text extraction.
2. The Agent follows the dependency instructions in SKILL.md.
3. It runs pip install pysqlite3 or pip install pypdf.
4. pip resolves the current package release and transitive dependencies from its configured index without enforcing reviewed versions or hashes.
5. If a resolved artifact or configured index is compromised, package-controlled code executes in the installation environment.
6. The malicious code gains the same operating-system privileges and accessible resources as the Agent or user running pip.

Impact Assessment

Successful exploitation could provide arbitrary code ...[truncated 575 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every package and transitive dependency to a reviewed version.

2. Require cryptographic hashes, such as with a hash-locked requirements file and pip install --require-hashes.

3. Use a lock file generated through a controlled dependency-review process.

4. Configure an explicit trusted package index rather than relying on ambient pip configuration.

5. Install dependencies in an isolated virtual environment under a non-privileged account.

6. Prefer Python's standard-library sqlite3 module when it satisfies the runtime requirements, avoiding pysqlite3.

7. Scan pinned artifacts for known vulnerabilities and review dependency updates before adoption.

8. Document exact installation commands, for example:

   bash

   python -m venv .venv
   . .venv/bin/activate
   python -m pip install --index-url https://pypi.org/simple \
     --require-hashes -r requirements.lock
   

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is presented as a schema design assistant, but its documented behavior explicitly includes operational actions such as creating databases, inserting records, querying, and exporting via exec. This scope expansion increases the chance an agent will perform state-changing actions on user systems when the user may have expected advisory-only behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The capability keyword list is excessively long and vague, lacking meaningful constraints or exclusions. This makes accidental over-triggering more likely, which is particularly risky because the skill advertises write and exec-backed workflows that can alter local state.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill claims it is not suitable for database architecture design decisions, yet the surrounding content repeatedly recommends schema structure, indexing, FTS strategy, and storage-layer choices. This contradiction can mislead routing and trust decisions, causing the skill to be invoked outside its stated safe scope.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document's own instructions perform architecture decisions despite stating that such decisions are not suitable for this skill. This internal inconsistency can cause unsafe or inappropriate delegation, especially if an agent uses the stated exclusions for safety gating while still following the detailed implementation advice.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger condition 'use when database operations, SQL queries, or data storage management are needed' is so broad that it can intercept many ordinary conversations. In an agent environment with exec/write tools, overly broad activation increases the risk of the skill being invoked unnecessarily and leading to unwanted file or database modifications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill includes concrete steps to create directories, create tables, and insert data through command execution, but it does not prominently warn that these are state-changing operations affecting user files and databases. In a tool-enabled agent, this omission can lead to silent or poorly understood modification of user environments and potential data loss or corruption.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The stated purpose is database schema design and SQLite-oriented modeling, which does not justify network diagnostic capability. Telling the agent to execute ping and troubleshoot firewall/proxy settings introduces a capability unrelated to the declared scope.

Content

No source excerpt is available for this finding.