Security audit

Snowflake MCP Connection

Security checks across malware telemetry and agentic risk

Overview

This is a legitimate Snowflake MCP setup guide, but it can give an AI client broad database access and exposes credential-handling and side-effect risks without enough guardrails.

Review this carefully before installing. Use a dedicated low-privilege Snowflake role and short-lived token, avoid ACCOUNTADMIN for runtime MCP access, keep mcp.json and Snowflake connection files out of source control and shared prompt context, restrict SQL to read-only where possible, and remove or strongly gate side-effecting tools such as Send_Email.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The skill’s stated purpose is connection and configuration, but it directly instructs users to create MCP servers exposing a SYSTEM_EXECUTE_SQL tool, which enables arbitrary SQL execution through an MCP client. In the context of an LLM-connected tool surface, this materially expands capability from passive connectivity setup to active database operations, increasing the risk of destructive queries, data exfiltration, or misuse if the client or prompts are compromised.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The inclusion of a custom Send_Email tool is outside the declared scope of wiring Snowflake MCP endpoints and materially adds an external side-effecting action. In an MCP/agent context, this enables an LLM-connected client to send messages or trigger workflows beyond data access, which can be abused for spam, phishing, data leakage, or unauthorized notifications.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The example file introduces outbound email capability via a custom stored procedure and MCP tool even though the skill is described as wiring Snowflake MCP endpoints and Cortex services. Adding an action-oriented side-effecting capability broadens the trust boundary and can enable data exfiltration, spam, or unauthorized notifications if copied into production without strict controls.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The custom Send_Email tool is outside the stated purpose of MCP connectivity/configuration and exposes a capability that can perform external actions. In the context of an agent-facing MCP server, such a tool can be invoked by workflows or prompts to transmit sensitive content, making accidental or abusive exfiltration materially more likely.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The documentation shows PATs embedded directly in curl commands and mcp.json without warning about secret handling. This encourages users to place bearer tokens in shell history, local files, logs, screenshots, or source control, which can lead to credential theft and subsequent unauthorized access to Snowflake MCP endpoints.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The guide shows Snowflake passwords and private-key passphrases directly in command arguments and configuration files, which can expose secrets through shell history, process listings, checked-in files, and broader filesystem access. In this skill’s context, the risk is heightened because it is an MCP setup guide likely to be copied verbatim by users, increasing the chance that real credentials are embedded in insecure locations.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.