Security audit

SQL查询引擎

Security checks for vulnerabilities and agentic risk

Overview

This SQL helper is not clearly malicious, but it requests execution and write authority while giving broad database, file, API, and command-operation guidance without tight safety boundaries.

Review this skill carefully before installing. Treat it as capable of guiding or triggering real database and system changes, and use it only in controlled environments with explicit user confirmation for any write, command execution, schema change, maintenance command, or external API call.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The skill states it cannot connect to a real database, yet it declares exec capability and includes live database-changing examples such as ALTER SYSTEM, VACUUM, and transactional updates. This mismatch can mislead users and downstream agents into treating the skill as advisory-only when it may trigger real side effects if wired to a database client or shell command path.

Intent-Code Divergence

Low

Confidence: 89% confidence
Finding: The file presents conflicting availability classifications, first indicating MD+EXEC and later MD-only. Ambiguity about whether execution is enabled weakens safety boundaries because an agent or user may assume a safer, documentation-only mode while the skill still exposes executable behavior.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The skill is advertised as a SQL guidance engine but later expands to generic file handling, API integration, and system command execution. This unnecessary capability breadth increases attack surface and makes prompt-driven misuse easier, since an ostensibly narrow database helper can be repurposed into a broader automation agent.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: The documentation claims generic external API integration even though the skill's stated purpose is SQL guidance. Unjustified network/API capability can enable exfiltration, remote command brokering, or unexpected outbound data flows if an agent implements the described behavior.

Context-Inappropriate Capability

Low

Confidence: 76% confidence
Finding: The skill documents generic file read/write behavior that is not clearly required for SQL guidance. Even if not overtly malicious, unnecessary filesystem capability broadens what the agent may touch and raises the risk of overwriting files, storing sensitive query outputs, or reading unintended local data.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The activation/use description is broad and ambiguous, effectively inviting the skill to handle any 'database operation' request without tight boundaries. Overbroad invocation criteria increase the chance that an agent applies this skill in unsafe contexts, including production operations or requests that exceed its intended advisory role.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill description exposes exec and write capabilities without a clear, front-loaded warning about side effects. In an agent ecosystem, this can cause users or orchestrators to invoke the skill assuming conversational guidance, while it may instead alter files, run commands, or trigger database operations.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The examples include system-altering SQL such as VACUUM ANALYZE, ALTER SYSTEM, configuration reloads, and transactional update patterns, but they are not surrounded by adequate operational safety guidance. In context, this is more dangerous because the skill also advertises exec capability, making it plausible that these examples are copied or executed against real environments.

Static analysis

No suspicious patterns detected.