Flexible Database De

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:49 AM UTC
• Version: 1.0.2

Overview

This skill is mostly advisory database-design guidance with expected local project file and command use, but users should review write actions and optional extraction steps.

Install this only if you want an agent to help design and possibly create SQLite database files, scripts, and data folders in a project. Review and approve file writes and shell commands first, pin any Python packages such as pypdf, and avoid LLM/API extraction for private PDFs or reports unless you are comfortable with the data leaving your machine or agent environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:96

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 96
Vulnerability Type: Unpinned package installation from an external package index
Risk Level: Medium

Vulnerable Code

markdown

4. **若内容为 PDF/文档**：归档前需提取正文（推荐 pypdf：`pip install pypdf`），扫描件无法提取时跳过。可选：将 PDF 复制到项目 `data/reports/` 统一管理，`file_path` 存相对路径；抽取器可从文件名解析 period、source、report_type。

Technical Analysis

The Skill recommends installing pypdf without pinning a reviewed version, requiring package hashes, using a lockfile, or identifying a trusted package index. Consequently, the installed artifact depends on mutable external package-index state at execution time.

This is a supply-chain weakness rather than evidence that pypdf itself is malicious. If the configured index, package account, dependency resolution process, or network path were compromised, an attacker-controlled distribution could be installed. Package installation and subsequent imports may execute code with the privileges of the Agent or user running the command.

Attack Path

1. A user requests PDF or document ingestion.
2. The Agent follows the instruction in SKILL.md.
3. The Agent runs pip install pypdf.
4. pip resolves and downloads the current package release from its configured external index without validating a project-supplied cryptographic hash.
5. If the package source or resolution channel has been compromised, attacker-controlled code enters the environment.
6. Malicious code may execute during installation or when the PDF library is imported and used.

Impact Assessment

Exploitation could provide code execution under the account running pip or the resulting scripts. The accessible scope may include project files, databases, environment variables, credentials available to that account, and network resources permitted by the runtime environment. This instruction does not request elevated privileges, so it does not independently grant adminis ...[truncated 22 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin pypdf to a specifically reviewed version rather than resolving the latest release.
2. Record the dependency in a lockfile or requirements file containing trusted hashes.
3. Install with hash enforcement, for example:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

4. Configure an explicitly trusted package index or an internally controlled package mirror.
5. Perform installation inside an isolated virtual environment or sandbox using a non-privileged account.
6. Review dependency updates before changing the pinned version and regenerate hashes through a controlled process.
7. Avoid using sudo or an administrator shell for dependency installation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest claims risk code was removed and security was enhanced, but the skill still declares exec capability and later instructs shell/file operations. Security-improving claims paired with retained command execution expand the chance that users or platforms over-trust a skill that can materially alter the local environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The workflow instructs the agent to copy files into user projects, create a data directory, and later run validation commands, but the skill does not prominently warn that it may write files and execute shell commands. Lack of upfront disclosure undermines informed consent and increases the risk of unintended local changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill recommends optional LLM/API-based extraction and configurable extractors without clearly warning that document or content data may be transmitted to external services. Users handling sensitive PDFs, reports, or knowledge-base material may unknowingly expose private data.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill presents contradictory statements about API key requirements, saying no extra API key is needed while later claiming the skill cannot be used without one. This can mislead users about external dependency and data-flow expectations, especially where optional LLM/API-based extraction may transmit content off-host.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger keywords are broad and poorly scoped, including generic terms like 'knowledge', 'guide', 'implement', and 'sqlite'. Overbroad triggers increase the chance of unintended activation in unrelated contexts, which is more concerning because the skill has file-writing and exec-adjacent behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill is framed as database-design guidance, but its manifest and body also position it to create files, run scripts, and modify project structure. This mismatch can cause users to invoke it expecting advisory behavior while it performs operational actions with broader risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The summary is written in Chinese and the skill heavily centers Chinese-language guidance, but there is no explicit statement that users may choose another language for interaction or output. This can be a language-policy issue when a skill imposes a default locale without offering user choice.

Content

No source excerpt is available for this finding.