ClawHub
Back to skill

Security audit

Sqlite Lite Manager Free

Security checks across malware telemetry and agentic risk

Overview

This skill is a local SQLite management guide with expected database write and maintenance operations, but users should apply care before modifying or deleting data.

Install only if you want an agent to help manage local SQLite files. Before allowing write, delete, cleanup, or VACUUM operations, verify the database path and table names, keep backups, and ask the agent to preview affected rows or run changes inside a transaction when possible.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The activation text is broad enough to match many generic requests about databases, SQL, storage, or data management, increasing the chance the skill is invoked outside the user's actual intent. Because the skill exposes read/write/exec-backed workflows and operational database actions, accidental invocation could lead to unnecessary file creation, modification, or execution-oriented behavior in contexts where a safer or narrower tool should have been used.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The keyword coverage list is excessively expansive and includes fragmented and generic phrases, which can cause accidental triggering on loosely related prompts. In an agent environment, this broad matching is risky because the skill has write and exec capabilities and may perform state-changing operations simply due to overbroad routing.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill documents destructive operations such as update and delete without warning about irreversible data loss, target validation, backups, or confirmation requirements. In an agent setting, users may issue ambiguous instructions and the absence of safety gates can cause unintended record deletion or modification in local databases.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
Cleanup and maintenance commands like expiring data removal and VACUUM can permanently delete records or rewrite the database file, yet the documentation presents them as routine actions without risk disclosure. In a local-agent context, that can lead to irreversible loss of cached, logged, or remembered data if invoked automatically or on the wrong database.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.