Database Schema Sync

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:51 AM UTC
• Version: 1.0.0

Overview

The skill’s database-sync purpose is clear, but it points users at an unreviewed production script and includes a verifier that can modify and over-approve that external script.

Review this skill carefully before installing. Only use it if you control and have reviewed the referenced sync-production-schema.py, fix the hard-coded path, make verification read-only, and require backups, least-privileged database credentials, dry-run review, and explicit human approval before any production --apply step.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/verify-sync-script.sh:4

Finding

Verifier Modifies Permissions on a Hard-Coded External File

Content

View full analysis

Vulnerability Details

File Location: scripts/verify-sync-script.sh, lines 4-14
Vulnerability Type: Unauthorized modification of external file permissions
Risk Level: Medium

Vulnerable Code

bash

SCRIPT_PATH="/Users/tobymorning/Desktop/core/scripts/sync-production-schema.py"

if [ ! -f "$SCRIPT_PATH" ]; then
    echo "❌ ERROR: Schema sync script not found at $SCRIPT_PATH"
    exit 1
fi

if [ ! -x "$SCRIPT_PATH" ]; then
    echo "⚠️  WARNING: Schema sync script not executable, attempting to fix..."
    chmod +x "$SCRIPT_PATH"
fi

Technical Analysis

The verifier operates on a fixed, user-specific absolute path outside the audited project. Rather than limiting itself to inspection, it changes the target file's executable permission without requesting confirmation and without verifying that the file belongs to the current project.

This violates least-privilege and package-boundary principles. A verification utility should not modify an unrelated external file, particularly one later intended to receive production database credentials. The script also does not check whether chmod succeeded, whether the target is a symbolic link, or whether the resolved path is an approved regular file.

Attack Path

1. An attacker with the ability to create or replace the file at /Users/tobymorning/Desktop/core/scripts/sync-production-schema.py places attacker-controlled Python code there.
2. The attacker ensures the file is initially not executable and may use a symbolic link or other filesystem redirection where local permissions permit.
3. A user runs scripts/verify-sync-script.sh as recommended by SKILL.md.
4. The verifier grants executable permission to the external file without validating its ownership, provenance, resolved location, or contents.
5. The documented production workflow subsequently directs the user or CI/CD system to run the file with access to DATABASE_URL.
6. The a ...[truncated 1058 chars]

Remediation

View remediation

Remediation Suggestions

• Include sync-production-schema.py in the project and resolve it relative to the verifier's own directory instead of using a user-specific absolute path.
• Make verification read-only. If executable permission is required but absent, report the condition and exit rather than invoking chmod.
• Resolve the canonical path and reject symbolic links or files outside the expected project root.
• Verify that the target is a regular file with expected ownership and restrictive permissions.
• Check every command's exit status and fail closed on any error.
• Require explicit administrative approval for any permission change.
• Review the schema script before providing production credentials and execute it under a dedicated, least-privileged database role.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/verify-sync-script.sh:17

Finding

Superficial String Checks Can Falsely Approve an Arbitrary Production Script

Content

View full analysis

Vulnerability Details

File Location: scripts/verify-sync-script.sh, lines 17-31
Vulnerability Type: Inadequate integrity and behavioral validation
Risk Level: Medium

Vulnerable Code

bash

# Check for required functions
if ! grep -q "def sync_" "$SCRIPT_PATH"; then
    echo "❌ ERROR: Schema sync script missing sync_ functions"
    exit 1
fi

if ! grep -q "table_exists" "$SCRIPT_PATH"; then
    echo "❌ ERROR: Schema sync script missing table_exists helper"
    exit 1
fi

if ! grep -q "column_exists" "$SCRIPT_PATH"; then
    echo "❌ ERROR: Schema sync script missing column_exists helper"
    exit 1
fi

echo "✅ Schema sync script verified and ready"
exit 0

Technical Analysis

The verifier treats the presence of three unrestricted text fragments as proof that a Python program is correctly configured and safe. These strings can appear in comments, inert string literals, unreachable code, or malicious code. The checks do not establish that:

• The file contains valid Python.
• The expected functions are real callable definitions.
• Dry-run mode prevents database changes.
• Apply mode uses transactions and safe SQL.
• Database identifiers and values are handled securely.
• The file matches a reviewed version or trusted digest.
• The script is free of unrelated commands, credential access, or data-exfiltration behavior.

Nevertheless, the verifier prints the authoritative message Schema sync script verified and ready. This creates false assurance around a script that SKILL.md directs operators to execute against production. The required scripts/sync-production-schema.py is absent from the audited package, so none of its claimed safety properties can be independently confirmed.

Attack Path

1. An attacker who can write to the hard-coded external script path creates an arbitrary Python program.
2. The attacker inserts def sync_, table_exists, and `column_exi ...[truncated 1378 chars]

Remediation

View remediation

Remediation Suggestions

• Package the referenced Python program inside the audited repository so its complete implementation is reviewable and version controlled.
• Replace substring searches with structural validation, such as parsing the file with Python's ast module and verifying expected classes, function definitions, signatures, and command-line handling.
• Pin the approved script to a reviewed cryptographic digest or verify a signed release artifact before production use.
• Add automated tests proving that --dry-run cannot execute mutating SQL and that --apply uses transactions with rollback on failure.
• Validate syntax with a non-executing compiler or parser and run static security checks.
• Reject unexpected imports, subprocess execution, network operations, or filesystem access unless explicitly required and reviewed.
• Change the success message to describe precisely what was checked; never claim that a script is ready based only on string presence.
• Use a least-privileged production database role and keep credentials available only for the shortest required execution window.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill instructs operators to run shell commands that can directly modify a production database, but it does not declare any tool restrictions or allowed-tools scope. In an agent setting, this creates an authorization gap where the agent may invoke shell access broadly and perform destructive actions beyond the narrowly intended schema-sync workflow, especially because the content includes explicit production apply commands.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This is a markdown file, so SQP-2 applies to omissions in user-facing safety warnings. The workflow includes --apply commands against staging and production databases, but the surrounding text does not explicitly warn about potential data loss, downtime, or the need for backups/change review before running live migrations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

Line L36 uses prescriptive natural language ('ALWAYS use sync script for production deployments') as a blanket organizational directive. This is a policy-style instruction presented without scope limits, exceptions, or justification, which can qualify as a natural-language policy constraint embedded in documentation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This shell script performs a file-modifying operation by running chmod +x on the target script when it is not executable. Although it prints a warning immediately before doing so, there is no confirmation prompt or prior disclosure beyond the inline message, and the operation alters the filesystem.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.