Security audit

Fox Data Analyst

Security checks for vulnerabilities and agentic risk

Overview

This data-analysis skill is mostly coherent, but it can run arbitrary SQL against configured databases without clear read-only safeguards or mutation warnings.

Install only if you are comfortable giving the agent access to the data sources you configure. Use read-only database credentials whenever possible, avoid production or regulated data unless explicitly intended, review every SQL statement before execution, and be careful rerunning the workspace initializer because it overwrites its template files.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The code chunk's actual behavior is narrowly focused on SQL query execution and optional CSV output. This aligns with the 'SQL queries' portion of the description and partially supports basic reporting/export, but it does not implement data visualization or spreadsheet automation. Because the declared description presents a broader multi-capability analyst tool while the supplied code only provides query execution/export functionality, the description does not accurately represent the actual code behavior.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill explicitly includes shell script execution examples and references executable scripts, but it declares no tool scope or permission boundaries. In an agent environment, this can cause the agent to invoke shell capabilities without clear restriction, increasing the risk of unintended command execution or access to local resources.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill encourages writing and executing SQL against databases but does not warn users that queries may modify or destroy live data. Because the examples and workflow normalize direct database access, an agent could issue destructive or privacy-impacting queries against production systems without user awareness.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The setup instructions tell users to connect live databases, spreadsheets, and warehouses, but they omit privacy, credential-handling, and sensitive-data warnings. In practice, this can lead agents or users to expose secrets, process regulated data unsafely, or connect production sources without safeguards.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The data cleaning section includes direct modification patterns such as UPDATE without warning that these changes may be irreversible or affect source-of-truth datasets. In an agent-assisted workflow, this increases the chance of accidental corruption, loss of provenance, or destructive edits to production data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This shell script performs a series of file writes using here-doc redirection into paths under ~/.openclaw/workspace/data-analysis. While it prints creation status messages, it does not explicitly disclose before execution that rerunning the script will overwrite template files such as README.md, SQL templates, markdown templates, and the Python script if they already exist.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The MySQL branch invokes mysql $DB_CONNECTION -e "$query" without quoting or safely parsing the connection argument, so shell metacharacters, word-splitting, or injected options in DB_CONNECTION can alter command execution before mysql runs. Because this script is designed for ad hoc queries and accepts --db plus environment-controlled input, a crafted connection string can lead to arbitrary command execution or unsafe mysql option injection on the host running the skill.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.