Security audit
Security checks for vulnerabilities and agentic risk
This skill claims to be a lightweight local SQLite helper but asks for broader execution authority and describes unrelated API, key, and command-execution behavior.
Review this carefully before installing. Use it only in a sandbox or limited workspace, do not provide API keys unless you have verified why they are needed, and require explicit confirmation before any delete, restore, shell command, or broad file operation.
Command execution is a powerful capability that is not justified by the stated purpose of a lightweight local SQLite skill. If an agent trusts this documentation, it may execute shell commands under the guise of database work, enabling arbitrary local actions, data destruction, or lateral abuse of the host environment.
Documenting backup/restore without warning about overwrite behavior, destination validation, or restore-side data loss can cause destructive mistakes during normal use. In an automation setting, restore actions may be executed quickly and repeatedly, making silent overwrite risks more severe.
The example shows a destructive delete operation without any warning, confirmation step, transaction guidance, or discussion of safe filtering. In a copy-paste driven agent context, that omission can lead to accidental data loss, especially when users treat examples as approved usage patterns.
The repeated mixing of local SQLite functionality with API keys, LLM services, and command-oriented behavior indicates scope confusion and overbroad operational intent. In agent ecosystems, this kind of deceptive or sloppy capability blending can bypass user expectations and lead to unsafe tool invocation decisions.
The skill is presented as a lightweight local SQLite utility, but the documentation introduces LLM/API dependencies, API-key handling, and network-oriented behavior that are unrelated to a local database helper. This mismatch can mislead agents or users into granting broader permissions or invoking external services unnecessarily, increasing attack surface and trust confusion.
The documentation advertises file processing, external API integration, and command execution even though the skill claims to be a minimal local SQLite tool. In an agent environment, such scope expansion is dangerous because it can cause the agent to use powerful capabilities far beyond the user’s likely expectation for a database helper.
External API integration is not justified for a local SQLite database skill and creates unnecessary pathways for data exfiltration or unexpected network communication. The danger is elevated because users would reasonably expect local-only data handling from the skill description.
