Security audit

Sql Gen

Security checks across malware telemetry and agentic risk

Overview

This SQL-generation skill is not clearly malicious, but it asks for broad agent powers and database-related authority without tight limits.

Review this before installing. Use it only with least-privilege database credentials, prefer read-only schema access by default, and require explicit confirmation before any migration, write, command execution, network call, or SQL execution. The artifact is not evidence of deliberate theft or damage, but its scope is too broad for automatic trust.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The skill is presented as a SQL generator, but the documentation also exposes broad command-execution capability that is not tightly scoped to SQL generation. In an agent environment with read/exec/write tools, this expands the attack surface and can enable arbitrary system actions if the skill is activated by loosely related prompts or abused through prompt injection.

Context-Inappropriate Capability

Low

Confidence: 85% confidence
Finding: Advertising generic external API integration beyond the stated SQL-generation purpose creates unnecessary privilege expansion and ambiguity about what outside systems the skill may contact. This makes data exfiltration, unexpected network access, or misuse of embedded credentials more plausible in contexts where the user expects only local SQL assistance.

Intent-Code Divergence

Low

Confidence: 78% confidence
Finding: The skill description uses inconsistent and overly broad positioning, mixing a narrow SQL-generation purpose with generic automation, batch processing, research, analysis, and writing-oriented framing. This increases the chance of over-triggering the skill in unrelated contexts, where its stronger tools could be used in ways the user did not intend.

Vague Triggers

High

Confidence: 95% confidence
Finding: The activation wording is broad enough to match generic efficiency or automation requests rather than specifically SQL-generation tasks. In agent systems, broad matching can cause this higher-privilege skill to be selected unexpectedly, increasing the risk of database access, file writes, or command execution in response to unrelated prompts.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The skill advertises database connections, file writing, command execution, and possible SQL execution-like flows without strong upfront warnings, constraints, or approval boundaries. In context, this is especially dangerous because the skill is framed as convenient automation and includes schema reading, migration generation, and references to execution/explain behavior, which could lead users or orchestrators to grant more trust than is warranted.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.