Sql Server Skills

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:01 AM UTC
• Version: 1.0.0

Overview

This is a legitimate SQL Server administration skill, but some examples handle credentials and high-impact SQL maintenance in ways users should review before installing.

Install only if you are comfortable giving the agent SQL Server access. Prefer Windows/integrated authentication or SQLCMDPASSWORD instead of -P for SQL passwords, use least-privilege SQL logins, and require human DBA review before running schema changes, backup/restore, DBCC FREEPROCCACHE, KILL, or generated ALTER/DROP statements. Treat query text, job history, error logs, and deadlock output as sensitive data.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:63
• Finding: SQL Credentials Exposed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 63–72 **Vulnerability Type**: Plaintext credential exposure through process arguments **Risk Level**: Medium ### Vulnerable Code ```bash # SQL Authentication sqlcmd -S "$SQL_SERVER" -U "$SQL_USER" -P "$SQL_PASSWORD" -d "$SQL_DATABASE" # Named instance + specific database sqlcmd -S "$SQL_SERVER" -U "$SQL_USER" -P "$SQL_PASSWORD" -d "$SQL_DATABASE" # Run a diagnostic script sqlcmd -S "$SQL_SERVER" -U "$SQL_USER" -P "$SQL_PASSWORD" -d master -i scripts/top-slow-queries.sql # Run with output to file sqlcmd -S "$SQL_SERVER" -U "$SQL_USER" -P "$SQL_PASSWORD" -d master -i scripts/wait-stats.sql -o results.txt -s "," -W ``` Equivalent vulnerable command patterns also appear in `README.md` and later workflow examples in `SKILL.md`. ### Technical Analysis The password is initially obtained from the `SQL_PASSWORD` environment variable, but the shell expands it before starting `sqlcmd`. Consequently, the plaintext password becomes part of the process argument vector through the `-P` option. Depending on the operating system, process isolation configuration, audit policy, and monitoring software, command-line arguments may be observable through: - Process-enumeration interfaces and administrative tools - Endpoint monitoring or application-performance monitoring agents - Process-creation audit records - Shell tracing such as `set -x` - Diagnostic captures, crash reports, or support bundles - Parent processes that record child-process arguments Using an environment variable does not mitigate this issue when its value is subsequently expanded into a command-line argument. ### Attack Path 1. A user follows the documented SQL Authentication workflow. 2. The shell expands `$SQL_PASSWORD` into the `sqlcmd -P` argument. 3. The plaintext password is placed in the running process's argument vector. 4. A local account, privileged monitoring component, audit collector, or process-inspection mechanism c ...[truncated 965 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Prefer integrated authentication and remove the password from the command entirely: ```bash sqlcmd -S "$SQL_SERVER" -E -d "$SQL_DATABASE" ``` 2. When SQL Authentication is unavoidable, use the supported `SQLCMDPASSWORD` environment variable without supplying the `-P` argument: ```bash export SQLCMDPASSWORD="$SQL_PASSWORD" sqlcmd -S "$SQL_SERVER" -U "$SQL_USER" -d "$SQL_DATABASE" unset SQLCMDPASSWORD ``` 3. Replace every documented `-P "$SQL_PASSWORD"` example in `SKILL.md`, `README.md`, and associated workflows. 4. Use a secrets manager or short-lived credential mechanism rather than persistent passwords. 5. Assign the SQL login only the permissions required for the selected workflow. Diagnostic accounts should not receive schema, restore, or server-administration permissions. 6. Disable shell tracing around secret-handling commands and configure monitoring systems to redact SQL credentials and environment variables. 7. Rotate any credentials that may previously have been exposed through process telemetry, audit logs, command history, or support bundles. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: sqlserver-indexes/references/index-strategies.md:103
• Finding: Dynamic Index Maintenance SQL Uses Unescaped Database Identifiers<![CDATA[ ## Vulnerability Details **File Location**: `sqlserver-indexes/references/index-strategies.md`, lines 103–119 **Vulnerability Type**: T-SQL injection through unsafe dynamic identifier construction **Risk Level**: High ### Vulnerable Code ```sql DECLARE @sql NVARCHAR(MAX); SELECT @sql = STRING_AGG( 'ALTER INDEX [' + i.name + '] ON [' + s.name + '].[' + o.name + '] REBUILD WITH (ONLINE = ON);', CHAR(13) ) FROM sys.dm_db_index_physical_stats(DB_ID(), NULL, NULL, NULL, 'SAMPLED') ips JOIN sys.indexes i ON ips.object_id = i.object_id AND ips.index_id = i.index_id JOIN sys.objects o ON i.object_id = o.object_id JOIN sys.schemas s ON o.schema_id = s.schema_id WHERE ips.avg_fragmentation_in_percent > 30 AND ips.page_count > 100 AND i.name IS NOT NULL; EXEC sp_executesql @sql; ``` ### Technical Analysis The maintenance script obtains index, schema, and object names from SQL Server catalog views and concatenates them directly into executable dynamic SQL. Square brackets are manually added around each identifier, but embedded closing brackets are not escaped. SQL Server identifiers can contain unusual characters when created using delimited identifiers. A closing bracket inside an attacker-controlled identifier can terminate the intended identifier context. Additional T-SQL tokens can then be introduced into the generated batch. The vulnerable values are: - `i.name` - `s.name` - `o.name` Because `EXEC sp_executesql @sql` immediately executes the aggregated statement, the generated SQL is not merely displayed for human review. The execution occurs under the permissions and execution context of the account running the maintenance operation. Parameterized queries cannot parameterize identifiers. SQL Server's `QUOTENAME` function must therefore be used to safely delimit each catalog identifier. ### Attack Path 1. An attacker obtains permission to create or rename a table, schema, or index in the target database. 2. The attacker creates a ...[truncated 1671 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Wrap every catalog-derived identifier with `QUOTENAME`: ```sql DECLARE @sql NVARCHAR(MAX); SELECT @sql = STRING_AGG( N'ALTER INDEX ' + QUOTENAME(i.name) + N' ON ' + QUOTENAME(s.name) + N'.' + QUOTENAME(o.name) + N' REBUILD WITH (ONLINE = ON);', NCHAR(13) ) FROM sys.dm_db_index_physical_stats(DB_ID(), NULL, NULL, NULL, 'SAMPLED') ips JOIN sys.indexes i ON ips.object_id = i.object_id AND ips.index_id = i.index_id JOIN sys.objects o ON i.object_id = o.object_id JOIN sys.schemas s ON o.schema_id = s.schema_id WHERE ips.avg_fragmentation_in_percent > 30 AND ips.page_count > 100 AND i.name IS NOT NULL; IF NULLIF(@sql, N'') IS NOT NULL EXEC sys.sp_executesql @sql; ``` 2. Run the maintenance script through an account limited to the required database and index-maintenance permissions. Avoid `sysadmin`. 3. Consider generating statements for explicit human review instead of immediately executing the aggregated batch. 4. Add an allowlist of schemas and exclude objects that are not owned or managed by the maintenance process. 5. Add regression tests using identifiers containing closing brackets, semicolons, quotes, Unicode characters, spaces, and SQL keywords. 6. Apply `QUOTENAME` consistently to other generated index statements in the project, even where statements are currently returned only as recommendations. This prevents future changes from converting safe display logic into unsafe executable dynamic SQL. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill documents `DBCC FREEPROCCACHE` as a tuning option, but this command clears cached execution plans instance-wide and can degrade performance for unrelated workloads by forcing widespread recompilation. Although it says 'use carefully in production' and labels it 'nuclear,' the guidance still presents a destructive operational action without a strong warning about blast radius, permissions, rollback limitations, or safer scoped alternatives.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill includes examples for dropping columns, dropping constraints, and dropping procedures without any adjacent warning about irreversible data loss or the need for backups/review. In a schema-management skill, users may copy these snippets directly into migrations or production workflows, increasing the risk of accidental destructive changes.

Static analysis

No suspicious patterns detected.