Security audit

Text2sql Engine

Security checks across malware telemetry and agentic risk

Overview

This is a database SQL-assistant skill, but it asks for broad command and file-writing authority that is not tightly bounded for a live-database context.

Install only if you intend to use it for DBA-style SQL generation and optimization, preferably with read-only database credentials. Review any generated DDL or command before execution, and avoid giving it production DATABASE_URL access unless your agent environment enforces explicit approval and scoped permissions.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The skill states that index recommendations are not automatically executed, but the skill exposes both exec and write capabilities and embeds executable DDL such as CREATE INDEX statements. In an agent setting, this mismatch can cause unsafe automation where generated SQL is executed against a live database, leading to schema changes, lock contention, or production impact.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: The documented capabilities include file handling, API integration, and command execution that are much broader than a text-to-SQL skill needs. Excessive capability scope increases the attack surface and can let prompt-influenced workflows pivot from harmless query generation into filesystem access, shell execution, or other unintended actions.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: The skill introduces external API usage and API-key configuration without clearly tying that network access to the NL2SQL function. Unnecessary networked dependencies can expose secrets, increase the chance of data exfiltration, and enable external calls triggered by untrusted user input or generated workflows.

Vague Triggers

Medium

Confidence: 78% confidence
Finding: The invocation description is broad enough to match generic database-operation requests, not just safe SQL drafting. In an agent ecosystem, over-broad activation can cause this high-capability skill to engage in contexts where users did not intend filesystem, execution, or database-affecting behavior, increasing the chance of unsafe actions.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The markdown advertises command execution, file writing, and external interactions without a prominent upfront warning that these actions can affect local systems and live databases. Missing safety disclosures make it easier for users or downstream agents to invoke the skill in risky ways without informed consent or proper safeguards.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.