ClawHub
Back to skill

Security audit

SQL生成器(免费版)

Security checks for vulnerabilities and agentic risk

Overview

This SQL helper is not malicious, but it enables execution-capable database workflows without clear guardrails against unintended live data changes.

Review generated SQL manually before use, especially INSERT, UPDATE, DELETE, CREATE TABLE, or any command run against a real database. Use least-privilege or read-only database accounts where possible, test in a sandbox first, and require explicit human approval before connecting this skill to production credentials or automated execution.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill explicitly supports generating INSERT, UPDATE, and DELETE statements and describes agent-driven data access workflows, but it does not prominently warn against executing generated SQL on real databases without review. In context, this is more dangerous because the skill advertises use by AI agents and includes exec capability, creating a credible path from natural-language input to destructive database actions or data integrity loss.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill is presented as an SQL generator/explainer, but its description and body broaden usage into database operations and agent-driven data access. This can cause an agent or user to invoke it in execution-adjacent contexts without recognizing that it may lead to live data modification workflows, increasing the chance of unsafe use.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The invocation guidance is very broad and covers general database operations, SQL queries, and storage management. In an agent ecosystem, overbroad routing criteria can cause this skill to be selected for routine requests involving sensitive data or destructive SQL tasks, increasing exposure to accidental misuse.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The document claims both that the tool uses schema-aware generation and that the free version does not support schema auto-sensing. This inconsistency can mislead operators about how much real-schema context the tool has, which may result in overtrust of generated SQL or unsafe assumptions during execution.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
72% confidence
Finding

The examples present JOIN usage as a core reference item, which can suggest supported generation capability, while the free-version section later says complex multi-table JOIN auto-generation is not supported. This is not merely incomplete wording; it can mislead users about what the free edition actually does.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.