ClawHub
Back to skill

Security audit

Snowflake MCP Connection

Security checks for vulnerabilities and agentic risk

Overview

This is a real Snowflake MCP setup guide, but it needs Review because it encourages highly privileged database access, broad SQL tools, and plaintext credential storage without enough safety controls.

Review before installing. Use a dedicated least-privilege Snowflake role instead of ACCOUNTADMIN, avoid exposing unrestricted SQL unless necessary, and require explicit approval for write, destructive, administrative, or email-sending actions. Store PATs, passwords, and key passphrases through a secret manager or protected environment mechanism rather than project files or command arguments, and pin any local MCP package versions before use.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:12
Finding

Administrative Snowflake Role Exposed Through Arbitrary SQL Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:12-34, SKILL.md:77-86; mcp-server-examples.sql:8-16
Vulnerability Type: Excessive privileges and unrestricted SQL execution
Risk Level: High

Vulnerable Code

SKILL.md:12-16:

markdown
### Prerequisites

- Snowflake account with ACCOUNTADMIN role
- Programmatic Access Token (PAT) from Snowflake
- Clawdbot or any MCP-compatible client

SKILL.md:25-34:

sql
CREATE OR REPLACE MCP SERVER my_mcp_server FROM SPECIFICATION
$$
tools:
  - name: "SQL Execution Tool"
    type: "SYSTEM_EXECUTE_SQL"
    description: "Execute SQL queries against the Snowflake database."
    title: "SQL Execution Tool"
$$;

SKILL.md:77-86:

sql
CREATE OR REPLACE MCP SERVER sql_mcp_server FROM SPECIFICATION
$$
tools:
  - name: "SQL Execution Tool"
    type: "SYSTEM_EXECUTE_SQL"
    description: "Execute SQL queries against Snowflake."
    title: "SQL Execution"
$$;

mcp-server-examples.sql:8-16:

sql
CREATE OR REPLACE MCP SERVER basic_mcp_server FROM SPECIFICATION
$$
tools:
  - name: "SQL Execution Tool"
    type: "SYSTEM_EXECUTE_SQL"
    description: "Execute SQL queries against the Snowflake database."
    title: "SQL Execution"
$$;

Technical Analysis

The setup names ACCOUNTADMIN as a prerequisite and exposes SYSTEM_EXECUTE_SQL to an MCP-connected AI client. ACCOUNTADMIN is Snowflake's highest-level administrative role and exceeds the permissions normally required for querying a defined dataset or invoking a narrowly scoped Cortex service.

The managed-server examples do not impose statement-level restrictions on the SQL tool. Effective access therefore depends on the role associated with the PAT and Snowflake RBAC. If the PAT is created for an administrative or otherwise broad role, tool calls may execute SQL with those broad permissions.

This creates a dangerous privilege bounda ...[truncated 1491 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove ACCOUNTADMIN from the prerequisites. Create a dedicated MCP service role with only the privileges required by the intended tools.
  2. Grant access only to explicitly required databases, schemas, tables, views, warehouses, Cortex services, functions, and procedures.
  3. Do not expose SYSTEM_EXECUTE_SQL when a Cortex Search, Analyst, Agent, or narrowly scoped stored procedure can satisfy the use case.
  4. Where SQL execution is necessary, default to read-only statements and explicitly reject DDL, DML, privilege-management commands, procedure calls, and unrecognized statement types.
  5. Use secure views, row-access policies, masking policies, and network policies to constrain data exposure.
  6. Create short-lived, dedicated credentials for the MCP service rather than reusing administrator credentials.
  7. Require explicit human approval for destructive, administrative, or high-cost operations.
  8. Enable Snowflake query auditing and alert on privilege changes, bulk exports, destructive statements, and unusual query volume.

T08 · Insecure Dependencies

Warning
Location
mcp-client-setup.md:35
Finding

Unpinned Third-Party Packages Are Downloaded and Executed

Content
View full analysis

Vulnerability Details

File Location: mcp-client-setup.md:35-39, mcp-client-setup.md:48-64
Vulnerability Type: Unpinned runtime dependencies and mutable package execution
Risk Level: Medium

Vulnerable Code

mcp-client-setup.md:35-39:

bash
# Install uv package manager
brew install uv
# or
pip install uv

mcp-client-setup.md:48-64:

json
{
  "mcpServers": {
    "snowflake": {
      "command": "uvx",
      "args": [
        "snowflake-labs-mcp",
        "--service-config-file",
        "~/.mcp/snowflake_config.yaml",
        "--account", "your-account.region",
        "--user", "your_username",
        "--password", "your_password"
      ]
    }
  }
}

Technical Analysis

Neither uv nor snowflake-labs-mcp is pinned to a reviewed version or integrity digest. The uvx invocation can resolve, download, and execute a package at runtime. Consequently, the code that executes may change after the Skill itself has been reviewed.

This is a supply-chain weakness rather than evidence that the named packages are currently malicious. A compromised publisher account, package registry, release pipeline, or transitive dependency could cause a later invocation to execute unexpected code. The configuration also gives the launched process access to Snowflake credentials and the permissions of the local user.

Attack Path

  1. A user installs uv without a version or integrity constraint.
  2. The user configures the MCP client to launch the unversioned snowflake-labs-mcp package through uvx.
  3. A package release, publisher account, registry entry, or transitive dependency is compromised or unexpectedly changed.
  4. On a subsequent MCP startup, uvx resolves and executes the changed package.
  5. The package runs with the local user's privileges and can access its arguments, configuration files, environment, and network.
  6. It can steal Snowflake creden ...[truncated 668 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin uv and snowflake-labs-mcp to exact, reviewed versions.
  2. Use a lockfile and cryptographic hashes for direct and transitive dependencies.
  3. Document the expected package registry and reject packages obtained from alternate or untrusted indexes.
  4. Prefer a preinstalled, verified executable over downloading package code during each MCP startup.
  5. Review release signatures, checksums, package ownership, and dependency changes before upgrading.
  6. Run the local MCP server as a dedicated, unprivileged operating-system account with restricted filesystem and network access.
  7. Keep Snowflake privileges minimal so compromise of the local package cannot provide broad database access.
  8. Add automated dependency and provenance scanning to the update process.

T09 · Insecure Skill Coding Practices

Error
Location
mcp-client-setup.md:12
Finding

Snowflake Credentials and Key Passphrases Stored in Plaintext

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:59-67; mcp-client-setup.md:12-20, mcp-client-setup.md:48-75, mcp-client-setup.md:103-114
Vulnerability Type: Plaintext secrets in project files, connection files, and process arguments
Risk Level: High

Vulnerable Code

SKILL.md:59-67:

json
{
  "mcpServers": {
    "Snowflake MCP Server": {
      "url": "https://YOUR-ORG-YOUR-ACCOUNT.snowflakecomputing.com/api/v2/databases/YOUR_DB/schemas/YOUR_SCHEMA/mcp-servers/my_mcp_server",
      "headers": {
        "Authorization": "Bearer YOUR-PAT-TOKEN"
      }
    }
  }
}

mcp-client-setup.md:12-20:

json
{
  "mcpServers": {
    "Snowflake MCP Server": {
      "url": "https://YOUR-ORG-YOUR-ACCOUNT.snowflakecomputing.com/api/v2/databases/YOUR_DB/schemas/YOUR_SCHEMA/mcp-servers/YOUR_MCP_SERVER",
      "headers": {
        "Authorization": "Bearer YOUR-PAT-TOKEN"
      }
    }
  }
}

mcp-client-setup.md:48-64:

json
{
  "mcpServers": {
    "snowflake": {
      "command": "uvx",
      "args": [
        "snowflake-labs-mcp",
        "--service-config-file",
        "~/.mcp/snowflake_config.yaml",
        "--account", "your-account.region",
        "--user", "your_username",
        "--password", "your_password"
      ]
    }
  }
}

mcp-client-setup.md:68-75:

toml
[default]
account = "your-account.region"
user = "your_username"
password = "your_password"
warehouse = "COMPUTE_WH"
role = "ANALYST_ROLE"

mcp-client-setup.md:103-114:

json
{
  "mcpServers": {
    "snowflake": {
      "command": "uvx",
      "args": [
        "snowflake-labs-mcp",
        "--service-config-file",
        "~/.mcp/snowflake_config.yaml",
        "--account", "your-account",
        "--user", "your_user",
        "--private-key-file", "~/.snowflake/rsa_key.p8",
        "--private-key-file-pwd", "ke
...[truncated 2308 chars]
Remediation
View remediation

Remediation Suggestions

  1. Do not store PATs, passwords, or private-key passphrases directly in project-level MCP configuration.
  2. Integrate with an operating-system keychain, enterprise secret manager, or another protected credential provider.
  3. Prefer short-lived credentials, external-browser authentication, workload identity, or key-pair authentication that does not require an inline passphrase.
  4. Avoid transmitting secrets as command-line arguments. Use a protected credential file descriptor or supported secret-provider integration.
  5. Keep secret-bearing files outside project directories and explicitly exclude them through .gitignore and repository secret-scanning controls.
  6. Apply restrictive filesystem permissions, such as owner-only access, to Snowflake connection profiles and private keys.
  7. Do not add secret-bearing configuration files to AI context, logs, tickets, or support bundles.
  8. Add automated pre-commit and CI secret scanning.
  9. Use dedicated least-privilege Snowflake roles and rotate credentials regularly.
  10. Immediately revoke and replace any credential that has been committed, logged, shared, or exposed to an untrusted context.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (19)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md
### Prerequisites

- Snowflake account with ACCOUNTADMIN role
- Programmatic Access Token (PAT) from Snowflake
- Clawdbot or any MCP-compatible client

### Step 1: Create Programmatic Access Token (PAT)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md
### Prerequisites

- Snowflake account with ACCOUNTADMIN role
- Programmatic Access Token (PAT) from Snowflake
- Clawdbot or any MCP-compatible client

### Step 1: Create Programmatic Access Token (PAT)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md
### Step 1: Create Programmatic Access Token (PAT)

1. In Snowsight, go to your user menu → **My Profile**
2. Select **Programmatic Access Tokens**
3. Click **Create Token** for your role
4. Copy and save the token securely

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · mcp-client-setup.md (reported line 42)May include surrounding context.

md
### Step 1: Create Programmatic Access Token (PAT)

1. In Snowsight, go to your user menu → **My Profile**
2. Select **Programmatic Access Tokens**
3. Click **Create Token** for your role
4. Copy and save the token securely

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The custom email-sending procedure is not necessary for demonstrating Snowflake MCP connectivity and introduces an outbound side-effecting capability that could be abused for spam, data exfiltration, or unauthorized communications. Because it is presented as a normal example alongside setup guidance, users may deploy it without evaluating whether such a tool is appropriate or safely constrained.

Content

No source excerpt is available for this finding.

MCP Config Access

High
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Content

Scanner excerpt · mcp-server-examples.sql (reported line 179)May include surrounding context.

text
-- UTILITY QUERIES
-- -----------------------------------------------------------------------------

-- List all MCP servers in current schema
SHOW MCP SERVERS;

-- Describe an MCP server

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

Step 3: Test the Connection

Verify with curl (replace placeholders):

bash
curl -X POST "https://YOUR-ORG-YOUR-ACCOUNT.snowflakecomputing.com/api/v2/databases/YOUR_DB/schemas/YOUR_SCHEMA/mcp-servers/my_mcp_server" \

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill instructs users to place a Snowflake PAT directly into mcp.json, which stores a live bearer credential in plaintext on disk. Plaintext secrets are at risk of accidental commit to source control, leakage through logs or support bundles, and compromise by other local processes or users with filesystem access.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill is presented as a connection/setup guide for Snowflake MCP, but it also normalizes inclusion of action-capable tools such as a generic email-sending procedure. That broadens the available capability set beyond the stated purpose and can lead users to expose write or outbound-action primitives in contexts where they expected only connectivity validation and data access.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The email-sending example introduces an outbound action that is unrelated to the skill's core purpose of configuring Snowflake MCP connectivity. In an MCP context, exposing such a tool can enable unintended external communication, abuse of trusted infrastructure, or prompt-driven actions that users did not anticipate from a setup guide.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 224)May include surrounding context.

List available tools:

bash
curl -X POST "https://YOUR-ACCOUNT.snowflakecomputing.com/api/v2/databases/DB/schemas/SCHEMA/mcp-servers/SERVER" \
  -H "Authorization: Bearer PAT" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The managed-server example documents use of a bearer PAT token directly in mcp.json and references private key material elsewhere without any privacy or secret-handling guidance. This is risky because MCP/client config files are frequently copied, checked into source control, or attached to AI sessions, exposing long-lived authentication material.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The guide provides example configurations containing plaintext --password values and a connections.toml password field without any warning about secret handling, storage permissions, or safer alternatives. In an agent/MCP setup guide, users often copy examples verbatim, which can lead to hardcoded credentials in files, shell history, repos, or shared session context.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
95% confidence
Finding

The guide recommends creating a persistent ~/.snowflake/connections.toml file containing a plaintext password, which increases the chance of credential exposure through local compromise, backups, dotfile syncing, or accidental sharing. In the context of an MCP client setup, persistent credentials are especially sensitive because they may grant broad database access and be reused by automated tools.

Content

Scanner excerpt · mcp-client-setup.md (reported line 81)May include surrounding context.

Using Connection File

Create ~/.snowflake/connections.toml:

toml
[default]

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The examples go beyond basic connectivity or configuration and provide ready-to-deploy operational MCP servers with high-capability tools such as SQL execution, Cortex agent access, and email sending. In the context of a setup skill, this increases the chance that users deploy broad-action servers without narrowing scope, least-privilege controls, or understanding the consequences of exposing those tools to MCP clients.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The custom Send_Email tool enables outbound communication but the example does not include any explicit warning that invoking it has real-world side effects. This can lead users or downstream agents to treat it like a harmless demo capability, increasing the risk of unauthorized messages, social engineering, or data leakage through email content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The full-featured server bundles an email-sending tool with other powerful capabilities and provides no explicit caution about outbound effects. Combining action tools with broad query and agent capabilities raises the chance of accidental or policy-violating use, especially if the MCP server is adopted as a template.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The example shows users sending a live authentication token in network requests, which can expose sensitive credentials through shell history, screenshots, or copied commands. Because the markdown lacks any cautionary note about token handling, it misses a relevant user warning for a security-sensitive operation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

This SQL example file contains user-facing natural-language tool descriptions such as querying data "using natural language" and agent behaviors that answer questions, but nowhere indicates support for multiple languages or a user language choice. Under the stated policy, forcing or implicitly assuming a specific language without opt-in can be a locale-policy issue.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.