ClawHub
Back to skill

Security audit

SQL Server Skills

Security checks for vulnerabilities and agentic risk

Overview

This database administration reference discloses its powerful operations and requires administrator review for disruptive changes.

Use a minimally privileged diagnostic identity and protect diagnostic reports and backups. Have a DBA review production changes, and resolve missing script references before following those workflows.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md
dependencies:
  - sqlcmd
---

# SQL Server Skills — Comprehensive Reference

This skill provides complete reference and workflows for Microsoft SQL Server diagnostics,
performance tuning, index management, execution plan analysis, and more.
It covers 7 domains via sqlcmd and T-SQL DMV queries targeting SQL Server 2016+.

---

## Overview


# SQL Server Skills

Comprehensive SQL Server skill for AI agents. Covers performance diagnostics, index analysis, execution plan interpretation, query optimization, schema management, backup/restore, and monitoring — all via `sqlcmd` and T-SQL DMVs.

---

## Requirements

- **`sqlcmd`** — [Microsoft Download](https://learn.microsoft.com/en-us/sql/tools/sqlcmd/sqlcmd-utility)
- **SQL Server 2016+** — All DMV queries target compatibility level 130+
- **Permissions** — `VIEW SERVER STATE` for most DMV queries; operation-specific least privilege and exact-target DBA review for changes

---

## Quick Connect

Prefer integrated authentication (`

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
90% confidence
Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · SKILL.md (reported line 330)May include surrounding context.

md
new staging database and new files first. Inspect HEADERONLY and FILELISTONLY,
verify the full/differential/log chain and recovery point, and confirm every MOVE
path avoids existing files. Determine whether a tail-log backup is needed and possible
to preserve recent work before restoring. Do not add REPLACE to bypass safety checks.
NORECOVERY keeps the database unavailable for further restores; RECOVERY ends that
restore sequence. Confirm client cutover, dependencies, capacity and outage timing.

Instruction Override

High
Category
Prompt Injection
Confidence
90% confidence
Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 330)May include surrounding context.

md
new staging database and new files first. Inspect HEADERONLY and FILELISTONLY,
verify the full/differential/log chain and recovery point, and confirm every MOVE
path avoids existing files. Determine whether a tail-log backup is needed and possible
to preserve recent work before restoring. Do not add REPLACE to bypass safety checks.
NORECOVERY keeps the database unavailable for further restores; RECOVERY ends that
restore sequence. Confirm client cutover, dependencies, capacity and outage timing.

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 330)May include surrounding context.

md
new staging database and new files first. Inspect HEADERONLY and FILELISTONLY,
verify the full/differential/log chain and recovery point, and confirm every MOVE
path avoids existing files. Determine whether a tail-log backup is needed and possible
to preserve recent work before restoring. Do not add REPLACE to bypass safety checks.
NORECOVERY keeps the database unavailable for further restores; RECOVERY ends that
restore sequence. Confirm client cutover, dependencies, capacity and outage timing.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 1042)May include surrounding context.

md
Require exact-target DBA review of server, database, schema, table and index before
executing any proposal. Use least privilege (ALTER on the target table), check
constraints, query hints and other dependencies, and test in staging with a recovery
plan. Never automatically execute returned SQL. Capture index definitions before
changes; budget locks, transaction log, disk/tempdb capacity and a maintenance window.
Check ONLINE support for the edition and index type; online operations still take locks.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 1201)May include surrounding context.

md
ELSE 'SKIP'
    END                                                         AS recommended_action,

    -- Proposed T-SQL only: exact-target DBA review required; never auto-execute
    -- Validate ONLINE support and locking impact; do not silently switch to offline rebuild
    CASE
        WHEN ips.avg_fragmentation_in_percent > 30 THEN

Static analysis

No suspicious patterns detected.