Security audit

精简版Sqlite

Security checks for vulnerabilities and agentic risk

Overview

This skill mainly describes local SQLite use, but it also asks for broad read/write/exec authority and includes unclear API, network, file-processing, and command-execution scope.

Review this carefully before installing. Use it only in a constrained workspace or disposable database unless you are comfortable with the agent reading and writing files, running commands, and potentially following the broader API/network guidance in the skill text. Avoid providing API keys unless the publisher clarifies why a local SQLite skill needs them.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The skill is presented as a lightweight local SQLite capability, but these sections introduce LLM/API-key dependencies and network-related behavior that materially expand the trust boundary. This can mislead users into granting credentials or allowing outbound access they would not expect from a local database skill, increasing the risk of data exposure and misuse.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: Troubleshooting guidance that says local database connectivity depends on network status is inconsistent with SQLite's local-file model and signals that the skill may do more than advertised. Even if unintentional, this can confuse operators during incident response and mask unexpected external communication paths.

Intent-Code Divergence

High

Confidence: 96% confidence
Finding: The feature list broadens the skill from local SQLite into file processing, external API integration, and system command execution, which are materially more sensitive capabilities. Hidden or weakly disclosed expansion of scope is dangerous because users may invoke the skill expecting simple local SQL operations while it can read/write files, call remote services, or execute commands.

Intent-Code Divergence

High

Confidence: 95% confidence
Finding: These sections describe API auth failures, rate limiting, network timeouts, and command execution, all of which conflict with the claimed local-only SQLite behavior and suggest undeclared external/service-execution capability. Such inconsistencies increase the chance of credential exposure, unauthorized outbound requests, or unsafe command use under false assumptions about the skill's scope.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The examples include create, insert, update, and delete operations without clear warnings that they modify persistent data. In an agent context, users may copy these patterns directly, leading to accidental data loss or corruption because destructive effects are not highlighted before use.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: Advertising file writing, API integration, and command execution without upfront warnings obscures system-impacting and privacy-impacting behavior. Users may authorize or invoke the skill without understanding that it can change files, contact external services, or run commands, which is a meaningful safety and security risk.

Static analysis

No suspicious patterns detected.