Database Skill

• Outcome: Review
• Latest audit: May 29, 2026 · 9:39 PM UTC
• Version: 1.1.0

Overview

This appears to be a legitimate database skill, but it can affect live databases, credentials, and persisted query data in ways that need careful review before installation.

Install only if you trust the publisher with access to the intended Volcengine/database credentials and are comfortable with local persistence of query results and reports. Use least-privilege database accounts, avoid production credentials when possible, review any DML/DDL or kill_process action before execution, and clean up generated /tmp, DuckDB, workspace, and .env artifacts after sensitive work.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill exposes significant capabilities—environment access, local file read/write, and network/database operations—without declaring permissions or clearly constraining when they may be used. That creates a confused-deputy risk where a user may invoke powerful side effects, including credential configuration, local artifact persistence, and remote database access, without an explicit trust boundary.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The declared purpose frames the skill as a database workbench, but the instructions also authorize local credential management, local file ingestion, DuckDB-based cross-source analysis, and persistence of temporary databases and reports. This broader behavior expands the attack surface beyond what a user would reasonably infer, increasing the risk of unexpected local data access, credential changes, and sensitive data spillage into temporary artifacts.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The guidance explicitly expands the skill from database querying into local file ingestion and disk-persisted workflow state, including registering arbitrary local files and saving intermediate outputs and reports to disk. That materially broadens the skill’s effective capability surface beyond the declared database scope, increasing the risk of unintended local file access, sensitive data persistence, and cross-source data exfiltration if an attacker can influence paths or analysis inputs.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The documentation requires use of report-writing tooling and Playwright-based browser automation even though those capabilities are not clearly disclosed in the skill metadata. Hidden or under-declared output and browser capabilities are dangerous because they expand the trust boundary: generated reports may persist sensitive query results, and browser automation can introduce additional attack surface or unintended external interaction depending on runtime configuration.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The analyzer accepts arbitrary SQL and executes it on a writable DuckDB connection backed by a shared on-disk database. In this skill context, data analysis should typically be constrained to read-only analytical queries, but the current design permits DDL/DML and destructive statements such as DROP, DELETE, CREATE, ATTACH, or COPY, which can alter persisted local state and potentially interact with local files depending on DuckDB features enabled.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The skill exposes an active `kill_process` capability that can terminate live database sessions, which goes beyond passive metadata/diagnostic behavior and creates a direct operationally destructive primitive. In an agent setting, natural-language misuse, prompt injection, or parameter confusion could cause denial of service against production databases by killing legitimate connections in bulk.

Intent-Code Divergence

High

• Confidence: 95% confidence
• Finding: The module-level claim that functions are side-effect-free except cache writes is contradicted by functionality that updates `.env` credentials and kills database processes. This mismatch is dangerous because agents, reviewers, or orchestration layers may trust the description and invoke the tool in contexts that assume read-only behavior, increasing the chance of accidental destructive actions.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The skill instructs the agent to autonomously execute database tasks and not repeatedly confirm user intent, while the supported actions include querying potentially sensitive metadata and data across production-like databases. In this context, autonomous execution without a prominent user-facing warning or confirmation boundary can lead to overcollection, accidental access to sensitive records, or analysis of the wrong instance/database.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The guide includes DELETE and data-changing examples, including a physical delete example, but does not pair them with an explicit warning to verify the target environment, affected row scope, backups, or transaction/rollback strategy before execution. In a database-operation skill, users may copy examples directly into production, so the omission increases the risk of accidental data loss or unintended modification.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The document recommends writing profiling outputs such as maximum length and enumerated value lists back into a metadata system, but it does not warn that profiling can surface sensitive values, quasi-identifiers, or production-scale scans. In a database skill with broad access across multiple engines and public/self-hosted data sources, this can encourage users to persist sensitive summaries or run heavy aggregation queries on production tables without safeguards.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The symptom quick-reference includes very broad phrases such as “帮我看看” and “很慢”, which are common everyday expressions that can appear in many unrelated conversations. In a high-impact database operations skill, such vague triggers can cause unintended invocation and route the agent into diagnostic or data-access workflows without sufficiently clear user intent.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The code stores imported data in a persistent DuckDB file under the system temp directory without clear user disclosure or consent. In a database-analysis skill, users may pass sensitive rows from production systems; silently writing that data to disk increases exposure through local file access, backup artifacts, shared temp directories, or later reuse by other runs.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: `update_env` persists sensitive values such as access keys and secret keys to a `.env` file without any interactive warning, confirmation, masking, or secure storage controls. This can lead to long-lived credential exposure on disk, accidental overwrite of valid credentials, and later leakage through backups, logs, or workspace access.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: `_truncate_list` writes full JSON payloads to `/tmp` when responses are large, and those payloads may contain database metadata or operational data that should not be broadly accessible. Temporary directories are a common leakage point because files may be readable by other processes/users, survive longer than intended, or be collected by diagnostics and backups.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: `_dump_artifact` persists potentially sensitive database and session data, including connection details, into `/tmp` JSON files for later access. In this skill context, those artifacts may include operationally sensitive information about users, hosts, databases, and queries, which meaningfully increases exposure if the host or workspace is shared.

Credential Access

High

• Category: Privilege Escalation

Content

凭证通过 `create_client()` 初始化时自动加载（优先级：环境变量 > `skills/.env` 文件）。

### ⚠️ 严禁直接操作 .env 文件

- **绝对禁止**用 Write / Edit / shell 命令直接读写 `.env` 文件
- **绝对禁止**通过 shell 命令（如 `echo $VOLCENGINE_ACCESS_KEY`）检查凭证

• Confidence: 91% confidence
• Finding: .env

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/dbw_client.py:218