Security audit
Security checks for vulnerabilities and agentic risk
This is a local SQLite guidance skill whose requested file, command, and write access fit its stated database-management purpose, with some documentation cautions users should notice.
Install only if you want an agent to help inspect and operate local SQLite databases. Before letting it run write, reset, import, schema, or VACUUM commands on valuable data, ask for the exact command and make a backup.
The skill advertises create/query/export as well as modify/reset/import operations without prominent warnings that these actions can alter or destroy local data. Given the declared availability of write and exec tools, an agent may perform state-changing operations too readily, especially when handling ambiguous user requests or existing production-like SQLite files.
The trigger condition '需要数据库操作、SQL查询、数据存储管理时使用' is broad enough to activate on generic database requests outside SQLite-specific intent. In an agent ecosystem with read/write/exec capabilities, overbroad routing can cause this skill to handle tasks it is not suited for, increasing the chance of unintended command execution or modification of local databases.
At L285-L286 the skill explicitly states it is based on local SQLite only and 'does not involve cloud service calls'. However, the error-handling section at L298 discusses network connectivity failures and proxy/firewall troubleshooting, which contradicts the stated local-only execution model rather than merely omitting detail.
No suspicious patterns detected.
