Security audit

Text2sql Engine Free

Security checks across malware telemetry and agentic risk

Overview

The skill appears to be a SQL generator, but its documentation also describes broader database actions and requests write/exec-style authority without clear boundaries.

Review before installing. Use this only as a SQL drafting helper unless the publisher clarifies the write/exec permissions, database connection handling, and whether any generated SQL may be executed or exported by the agent. Avoid giving it production database credentials or broad database access.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The skill claims elsewhere that it only generates SQL and does not execute queries, yet these sections advertise create/query/export, modify/reset/import, and save/convert style operations. This inconsistency can mislead an agent or user into permitting state-changing or data-moving actions under the guise of a read-only SQL generator, increasing the chance of unintended execution or exfiltration.

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: The free-version description limits the feature set to basic SQL generation, but later capability text broadens scope to generic operational workflows and parameterized actions. That mismatch weakens trust boundaries and can cause downstream systems to invoke the skill for tasks beyond its safe, documented purpose.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The FAQ states that generated SQL will not be executed automatically, but other parts of the skill describe query, modify, import, export, and execution-oriented behavior. Contradictory safety claims are dangerous because operators may rely on the safer statement while the implementation or invocation path still enables impactful actions.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The activation description is broad enough to match many normal analytics, reporting, and development requests, which can cause the skill to trigger in contexts where users did not intend SQL generation or where database access should be more tightly controlled. Overbroad routing increases the chance of unnecessary exposure of schema, credentials, or sensitive data workflows.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The capability coverage section lists an excessively broad set of scenario keywords, effectively turning descriptive text into a catch-all trigger. This can cause accidental invocation on loosely related prompts, expanding the blast radius of a skill that advertises exec/write tooling and ambiguous operational capabilities.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill advertises create/export/save/modify/import operations without clear warnings, guardrails, or confirmation requirements for data-affecting behavior. In a database-related skill, such verbs imply potential writes, destructive changes, or bulk data movement, which are high-risk if an agent infers permission from the documentation.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.