ClawHub
Back to skill

Security audit

DolphinDB 基础操作技能

Security checks for vulnerabilities and agentic risk

Overview

This DolphinDB skill is coherent for database CRUD, but it requires running unreviewed setup scripts and includes admin/destructive database examples without enough safeguards.

Review before installing. Only use this skill if you trust and have verified the separate dolphindb-skills setup scripts it sources, change any default DolphinDB admin password, use least-privileged database accounts, and require explicit backups and target checks before running DELETE, DROP, or partition-removal examples.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:8
Finding

Mandatory Execution of Unverified External Initialization Scripts

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8-14
Vulnerability Type: Unverified local dependency execution
Risk Level: High

bash
# Method 1: Run inside the skill directory
cd ~/.jvs/.openclaw/workspace/skills/<skill-name>
source ../dolphindb-skills/scripts/dolphin_wrapper.sh

# Method 2: Run from any location
source ~/.jvs/.openclaw/workspace/skills/dolphindb-skills/scripts/dolphin_global.sh

# Method 3: Manual detection
python3 ~/.jvs/.openclaw/workspace/skills/dolphindb-skills/scripts/init_dolphindb_env.py

Technical Analysis

The skill requires users or agents to source or execute initialization files from a separate dolphindb-skills directory that is not included in the audited project. Consequently, the contents, version, provenance, integrity, ownership, and permissions of those files cannot be verified from this package.

The shell source command is particularly sensitive because it executes the referenced file in the current shell rather than an isolated child process. Such a script can modify environment variables, redefine commands or functions, change the working directory, access credentials available to the process, and execute arbitrary commands with the invoking user's permissions. The Python initialization script similarly represents an unaudited execution dependency.

The same mandatory procedure is duplicated at lines 29-35, increasing the likelihood that an agent will execute it without validating the referenced files.

Attack Path

  1. An attacker gains write access to the referenced sibling skill directory, replaces one of the initialization files, or causes an untrusted version of dolphindb-skills to be installed at the expected path.
  2. The user or agent follows the mandatory setup instructions.
  3. The shell sources dolphin_wrapper.sh or dolphin_global.sh, or Python executes init_dolphindb_env.py.
  4. The modified dependency executes attacke ...[truncated 724 chars]
Remediation
View remediation

Remediation Suggestions

  • Bundle all required initialization scripts with the skill so they can be reviewed and versioned together.
  • Pin the expected dependency version and publish cryptographic hashes for every executable file.
  • Verify each file's hash, canonical path, owner, and permissions before execution; reject files writable by untrusted users.
  • Avoid source where possible. Execute initialization in a restricted subprocess and import only a documented allowlist of resulting environment values.
  • If sourcing is unavoidable, validate the script first and run the skill under a dedicated least-privileged account.
  • Use an explicit trusted installation root rather than resolving dependencies from mutable sibling directories.
  • Document the dependency's provenance and provide a secure installation and update procedure.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:68
Finding

Hardcoded Default Administrator Credentials in Connection Examples

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 68
Vulnerability Type: Hardcoded administrative credentials
Risk Level: Medium

python
s.connect(host="localhost", port=8848, userid="admin", password="123456")

The same connection pattern is repeated throughout the document, and the default administrator account is explicitly documented near line 548 as admin / 123456.

Technical Analysis

The examples embed a publicly known administrator username and password directly in source text. Because the documented workflows include database creation, updates, record deletion, table deletion, partition removal, and complete database deletion, copying the examples without changing the credentials can expose a highly privileged database account.

Hardcoded credentials also encourage plaintext secret storage in scripts, shell history, generated examples, logs, and source-control repositories. Use of the administrator account for routine CRUD operations violates least privilege and unnecessarily expands the impact of credential compromise.

Attack Path

  1. An operator copies the documented connection example without replacing the default password or creates a DolphinDB deployment that retains the documented default credentials.
  2. The DolphinDB service on port 8848 becomes reachable by another local user, container, internal network host, or external host due to its network configuration.
  3. An attacker authenticates using admin and 123456.
  4. The attacker uses administrator capabilities to query or modify data and, where permitted by the deployment, executes destructive operations such as DROP TABLE, DROP DATABASE, or partition deletion.
  5. If the same credentials are reused elsewhere, the compromise may extend to additional DolphinDB deployments.

Impact Assessment

Where the default credentials remain active and the service is reachable, exploitation may provide DolphinDB administrator ...[truncated 336 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace real-looking credentials with unmistakable placeholders such as YOUR_USERNAME and YOUR_PASSWORD.
  • Load credentials from a secret manager, protected configuration file, or environment variables rather than embedding them in scripts.
  • Require the default administrator password to be changed before the database accepts non-local connections.
  • Create separate least-privileged users for read, write, schema-management, and administrative operations.
  • Restrict port 8848 using host firewalls, network policy, private interfaces, or an authenticated gateway.
  • Add a prominent warning that the administrator account must not be used for routine CRUD examples.
  • Rotate any deployment credentials copied from the documentation and audit authentication logs for use of the known default account.
  • Prevent secrets from entering source control through secret scanning and pre-commit checks.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation provides direct examples for DELETE, DROP TABLE, DROP DATABASE, and partition deletion without requiring warnings, backups, scope validation, or user confirmation. In an agent skill context, such ready-to-run destructive examples can lead to irreversible data loss if copied or suggested automatically.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
78% confidence
Finding

SQP-3 适用于所有文件。整份技能文档以中文编写，并通过“强制流程”等措辞默认要求按该语言说明使用，但未说明这是面向特定中文用户群的区域性技能，也未提供其他语言选项或用户语言选择机制。若组织要求避免未经用户同意强制特定语言，这构成语言/locale 策略风险。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill broadly presents database creation, insertion, update, and deletion capabilities but lacks an overall warning that these operations modify persistent state. Because the document also includes default admin credentials and executable examples, users may apply them to live systems without understanding the operational risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger conditions include broad generic phrases such as 'SELECT', 'DROP', '创建数据库', and '基本操作', which can cause the skill to activate in contexts the user did not intend. In a database skill that documents state-changing and destructive operations, accidental invocation increases the chance of unsafe guidance being surfaced during unrelated conversations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.