T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:3- Finding
Overbroad Mandatory Skill Routing to a Third-Party Database Service
- Content
View full analysis
- Remediation
View remediation
Security audit
Kole By SyneHQ
Security checks for vulnerabilities and agentic risk
Overview
This database-querying skill is coherent and disclosed, but it needs Review because it can broadly route requests into an external MCP service that runs unpinned code with database credentials and SQL/DDL authority.
Install only if you intentionally want SyneHQ Kole connected to your databases. Use a dedicated read-only database user and a narrowly scoped SyneHQ API key, avoid production until tested, pin and review the MCP package version instead of using @latest, and require explicit confirmation before listing connections, inspecting schemas, running queries, or executing any DDL.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Error
- Location
SKILL.md:51- Finding
Automatic Execution of an Unpinned Remote MCP Package
- Content
View full analysis
- Remediation
View remediation
``` 5. Remove automatic acceptance through `-y` from the runtime configuration. 6. Avoid global package installation. Install the dependency locally in an isolated directory with a committed lockfile. 7. Run the MCP server in a sandbox or container with: - A read-only filesystem where feasible. - Restricted outbound network access. - No access to unrelated user files or environment variables. - A dedicated, unprivileged operating-system identity. 8. Use a narrowly scoped API key and read-only database identities. Separate production and non-production credentials. 9. Rotate `SYNEHQ_API_KEY` immediately if an untrusted package version has already executed. 10. Establish a controlled dependency-update process that requires source review and security testing before changing the pinned version. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (18)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill’s activation criteria are extremely broad, including 'when user asks about their data' even without mentioning databases or SQL. This can cause the agent to route many ordinary data-related requests into a powerful external database-querying skill, increasing the chance of unnecessary access to sensitive databases and unintended external handling of user data.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - "Install MCP server: npm install -g @synehq/kole-mcp" - "Get SyneHQ account: curl https://data.synehq.com/api/auth-info" - "Sign up at: https://data.synehq.com/signup" - "Get API key from: https://data.synehq.com/dashboard → Settings → API Keys" - "Configure connection at: https://data.synehq.com/dashboard → Connections" - "Set environment variables: SYNEHQ_API_KEY and SYNEHQ_CONNECTION_ID (optional)" - "Add MCP server to .mcp.json or claude_desktop_config.json (see documentation below)"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - "Install MCP server: npm install -g @synehq/kole-mcp" - "Get SyneHQ account: curl https://data.synehq.com/api/auth-info" - "Sign up at: https://data.synehq.com/signup" - "Get API key from: https://data.synehq.com/dashboard → Settings → API Keys" - "Configure connection at: https://data.synehq.com/dashboard → Connections" - "Set environment variables: SYNEHQ_API_KEY and SYNEHQ_CONNECTION_ID (optional)" - "Add MCP server to .mcp.json or claude_desktop_config.json (see documentation below)"
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 74% confidence
- Finding
The documentation tells users to create a project-local .mcp.json after exporting API credentials, which can encourage persistent storage of connection configuration in the workspace. If that file contains secrets or sensitive connection metadata and is committed, shared, or left with permissive access, it can expose long-lived access to the database platform.
- Content
export SYNEHQ_API_KEY="your_api_key" export SYNEHQ_CONNECTION_ID="your_connection_id"
Create .mcp.json in your project
See main README for configuration details
text
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README instructs the agent to automatically use this skill for broad categories like 'data analysis' and even 'their data' without requiring explicit confirmation that database access is intended. In a skill that can drive database querying through an MCP server, this increases the chance of over-triggering on ambiguous prompts and could lead to unintended access, schema disclosure, or execution of sensitive queries against connected environments.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md requires_env: - name: SYNEHQ_API_KEY required: true description: "SyneHQ API authentication key. Get from https://data.synehq.com/dashboard → Settings → API Keys" security: "Grants access to query connected databases. Treat as sensitive credential. Do not commit to version control." - name: SYNEHQ_CONNECTION_ID required: false
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md requires_env: - name: SYNEHQ_API_KEY required: true description: "SyneHQ API authentication key. Get from https://data.synehq.com/dashboard → Settings → API Keys" security: "Grants access to query connected databases. Treat as sensitive credential. Do not commit to version control." - name: SYNEHQ_CONNECTION_ID required: false
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md requires_env: - name: SYNEHQ_API_KEY required: true description: "SyneHQ API authentication key. Get from https://data.synehq.com/dashboard → Settings → API Keys" security: "Grants access to query connected databases. Treat as sensitive credential. Do not commit to version control." - name: SYNEHQ_CONNECTION_ID required: false
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md requires_env: - name: SYNEHQ_API_KEY required: true description: "SyneHQ API authentication key. Get from https://data.synehq.com/dashboard → Settings → API Keys" security: "Grants access to query connected databases. Treat as sensitive credential. Do not commit to version control." - name: SYNEHQ_CONNECTION_ID required: false
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md requires_env: - name: SYNEHQ_API_KEY required: true description: "SyneHQ API authentication key. Get from https://data.synehq.com/dashboard → Settings → API Keys" security: "Grants access to query connected databases. Treat as sensitive credential. Do not commit to version control." - name: SYNEHQ_CONNECTION_ID required: false
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md requires_env: - name: SYNEHQ_API_KEY required: true description: "SyneHQ API authentication key. Get from https://data.synehq.com/dashboard → Settings → API Keys" security: "Grants access to query connected databases. Treat as sensitive credential. Do not commit to version control." - name: SYNEHQ_CONNECTION_ID required: false
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md requires_env: - name: SYNEHQ_API_KEY required: true description: "SyneHQ API authentication key. Get from https://data.synehq.com/dashboard → Settings → API Keys" security: "Grants access to query connected databases. Treat as sensitive credential. Do not commit to version control." - name: SYNEHQ_CONNECTION_ID required: false
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md requires_env: - name: SYNEHQ_API_KEY required: true description: "SyneHQ API authentication key. Get from https://data.synehq.com/dashboard → Settings → API Keys" security: "Grants access to query connected databases. Treat as sensitive credential. Do not commit to version control." - name: SYNEHQ_CONNECTION_ID required: false
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md requires_env: - name: SYNEHQ_API_KEY required: true description: "SyneHQ API authentication key. Get from https://data.synehq.com/dashboard → Settings → API Keys" security: "Grants access to query connected databases. Treat as sensitive credential. Do not commit to version control." - name: SYNEHQ_CONNECTION_ID required: false
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md requires_env: - name: SYNEHQ_API_KEY required: true description: "SyneHQ API authentication key. Get from https://data.synehq.com/dashboard → Settings → API Keys" security: "Grants access to query connected databases. Treat as sensitive credential. Do not commit to version control." - name: SYNEHQ_CONNECTION_ID required: false
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md requires_env: - name: SYNEHQ_API_KEY required: true description: "SyneHQ API authentication key. Get from https://data.synehq.com/dashboard → Settings → API Keys" security: "Grants access to query connected databases. Treat as sensitive credential. Do not commit to version control." - name: SYNEHQ_CONNECTION_ID required: false
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The reference includes a customer lifetime value query that directly selects identifiable user fields such as email and name alongside purchase history and behavioral metrics. In a skill explicitly intended to query user databases and analyze their data, providing PII-returning examples without any privacy warning, minimization guidance, or masking pattern increases the likelihood that operators will expose sensitive personal data unnecessarily.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The example uses PostgreSQL text search functions with the 'english' dictionary in both vectorization and query parsing, which bakes in a specific language assumption. Because the document does not mention locale constraints or alternatives, this is a natural-language policy issue under the language/locale rule.
- Content
Static analysis
No suspicious patterns detected.