ClawHub
Back to skill

Security audit

Text2sql Engine Free

Security checks for vulnerabilities and agentic risk

Overview

This SQL-generation skill is not clearly malicious, but it asks for command execution and file-writing powers that do not fit its stated “generate SQL only” behavior.

Install only if you are comfortable giving this skill command execution and file-writing authority, or constrain it to read-only/schema inputs. Review generated SQL yourself and do not provide real database credentials unless execution behavior is clarified and explicitly user-controlled.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:15
Finding

Excessive Command Execution and Filesystem Permissions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15-22
Supporting Locations: SKILL.md, lines 237, 265, and 286
Vulnerability Type: Excessive tool permissions and ambiguous permission configuration
Risk Level: Medium

Vulnerable Code

yaml
tools:
- - read
- exec
homepage: https://skillhub.cn
pricing_tier: L2
pricing_model: per_use
suggested_price: 19.9
tools: ["read", "write", "exec"]

The permission declaration is inconsistent with the documented behavior. The Skill states at line 237 that it only generates SQL and does not execute database queries. Nevertheless, it requests general read, write, and exec capabilities. Line 265 also classifies the Skill as requiring command execution, while line 286 recommends executing ping for network troubleshooting.

Technical Analysis

The Skill's legitimate function is to transform user-provided natural-language requirements and schemas into SQL text. This task does not inherently require arbitrary command execution or unrestricted filesystem writes. Granting exec and write therefore violates the principle of least privilege.

The front matter also defines the tools key twice and uses inconsistent structures. YAML parsers may retain the first value, retain the last value, or reject duplicate keys depending on their configuration. Consequently, the effective permissions may be ambiguous across hosting platforms. Under last-key-wins parsing, the Skill receives all three capabilities: read, write, and exec.

No malicious command or automated exploitation logic is present in the reviewed file. The security risk arises because these unnecessary capabilities expand the consequences of prompt injection, erroneous model behavior, or future untrusted instructions processed while the Skill is active.

Attack Path

  1. A platform loads SKILL.md and parses the final tools declaration.
  2. The platform grants the Skill fi ...[truncated 1419 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove exec because SQL text generation does not require operating-system command execution.

  2. Remove write unless the user explicitly requests export to a file. If export is supported, request narrowly scoped write access only for a user-approved destination and only for that operation.

  3. Retain read only if loading schema files is an intended feature. Restrict access to files explicitly selected by the user.

  4. Replace the duplicate declarations with one unambiguous metadata entry, for example:

    yaml
    tools: ["read"]

    If schema content is always supplied directly in the prompt, use an empty tool list instead.

  5. Remove the MD+EXEC classification and the recommendation to execute ping, or move network diagnostics into a separate, explicitly authorized administrative workflow.

  6. Configure the host to deny undeclared capabilities, sandbox command execution, constrain filesystem paths, block unnecessary network access, and require confirmation before any privileged operation.

  7. Add automated metadata validation that rejects duplicate YAML keys and flags tool permissions not justified by documented functionality.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill documentation repeatedly states it only generates SQL and does not execute queries, but the manifest grants write and exec and nearby sections describe create/modify/export/save style operations. This mismatch can mislead an agent or user into authorizing a skill with broader side effects than expected, enabling command execution or file modification under the guise of safe SQL generation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The FAQ says the skill will not execute queries, yet other sections describe using exec and even direct test-database execution. Contradictory safety claims are dangerous because an agent may trust the safer statement while the skill still has instructions and capabilities that lead to real execution against local tools or databases.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The description says to use the skill whenever data analysis, report generation, statistical insight, or data visualization are needed, which are broad everyday work contexts rather than specific trigger phrases or constrained invocation conditions. It provides only one exclusion and does not clearly define narrower trigger scope or negative examples, increasing the risk of unintended invocation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill claims coverage for a long list of keyword fragments such as '需要数据分析', '报表生成', and other broken phrases derived from the description. This does not provide a precise activation boundary and may cause matching on common language unrelated to deliberate text-to-SQL use.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Including shell-style exec for a skill whose stated purpose is natural-language-to-SQL generation violates least privilege. In this context, an LLM-driven text-to-SQL skill may transform user prompts or embedded content into commands that inspect the environment, invoke database clients, or chain into unintended local execution, increasing the risk beyond simple query generation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
78% confidence
Finding

The free-version limitations say '不支持查询解释', yet earlier sections describe structured processing/execution output and logs as part of capability execution. While not identical to inline SQL clause explanations, this documentation creates contradictory expectations about explanatory output in the free tier.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.