Security audit

Rust + SeaORM Database Explicit Contracts

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Rust/SeaORM database-guidance package, but its example and CI checker undercut rules it presents as mandatory, so users should review it before relying on it.

Use this skill only after reviewing the database safety examples. Do not rely on its bundled checker as a blocking security gate until state-transition and soft-delete violations fail CI correctly, and make sure generated code validates status transitions and soft-delete filters with tests or stronger project-specific checks.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: references/ENTITY_EXAMPLE.md:138
Finding: Canonical update example bypasses mandatory state-transition validation
Content: View full analysis
Remediation: View remediation
{:?}", task.status, next_status ))); } let mut active: task::ActiveModel = task.into(); active.status = Set(next_status); active.updated_at = Set(chrono::Utc::now()); active.update(db).await?; ``` Additional hardening measures should include: 1. Place transition validation in a centralized entity or service method rather than relying on every caller to repeat it. 2. Add tests for every allowed and prohibited transition. 3. Ensure externally supplied states are authorized in addition to being valid transitions. 4. Update the example documentation to explicitly identify transition validation as mandatory. 5. Consider concurrency controls, such as optimistic locking or a conditional update, when simultaneous state changes are possible. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: references/check_db_contracts.sh:149
Finding: Mandatory database-contract checks fail open in CI
Content: View full analysis
/dev/null; then warn "状态变更未见 can_transition_to 检查: $line" has_unchecked=true fi done if [ "$has_unchecked" = false ]; then ok "状态变更均有流转检查" fi else ok "未发现状态变更操作（或已过滤）" fi ``` The soft-delete check uses the same pipeline pattern: ```bash if [ -n "$entity_finds" ]; then echo "$entity_finds" | while IFS= read -r line; do file=$(echo "$line" | cut -d: -f1) lineno=$(echo "$line" | cut -d: -f2) # 检查该 find 调用后 10 行内是否有 is_deleted 过滤 has_filter=$(sed -n "${lineno},$((lineno + 10))p" "$file" 2>/dev/null | grep -c "is_deleted\|IsDeleted" || echo "0") if [ "$has_filter" -eq 0 ]; then warn "查询软删除表 ${entity_name} 但未见 is_deleted 过滤: $line" fi done fi ``` Warnings do not fail CI: ```bash if [ "$ERRORS" -gt 0 ]; then red " ❌ 发现 $ERRORS 个错误，$WARNINGS 个警告" exit 1 elif [ "$WARNINGS" -gt 0 ]; then yellow " ⚠ 无错误，$WARNINGS 个警告（建议修复）" exit 0 else green " ✅ 所有检查通过" exit 0 fi ``` ### Technical Analysis The checker treats missing state-transition validation and missing soft-delete filters as warnings, even though `SKILL.md` defines both as prohibited practices. The final control flow explicitly returns exit status zero when only warnings are detected, allowing CI to pass despite mandatory contract violations. There is also a Bash subshell issue. In the ...[truncated 2373 chars]
Remediation: View remediation
/dev/null; then error "State change has no can_transition_to check: $line" has_unchecked=true fi done < <(printf '%s\n' "$status_sets") if [ "$has_unchecked" = false ]; then ok "All detected state changes have transition checks" fi ``` Apply the same pattern to the soft-delete loop: ```bash while IFS= read -r line; do file=$(printf '%s\n' "$line" | cut -d: -f1) lineno=$(printf '%s\n' "$line" | cut -d: -f2) if ! sed -n "${lineno},$((lineno + 10))p" "$file" | grep -q "is_deleted\|IsDeleted"; then error "Soft-delete query has no is_deleted filter: $line" fi done < <(printf '%s\n' "$entity_finds") ``` Further hardening should include: 1. Use `error` rather than `warn` for every rule documented as mandatory. 2. Return a nonzero status for unresolved mandatory violations. 3. Add automated tests that feed known-bad Rust files to the script and assert that it exits nonzero. 4. Test warning and error counters after loops to prevent future subshell regressions. 5. Avoid using simple file-wide presence checks for `can_transition_to`; inspect the relevant update context or adopt a Rust-aware static-analysis tool. 6. Make all summary messages and exit statuses consistent so the script cannot print success after detecting a mandatory violation. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest description and the rest of the document are written entirely in Chinese and present the skill as automatically activating for relevant Rust + SeaORM work, but there is no opt-in or statement that the skill is intended only for Chinese-speaking users. This creates a natural-language policy concern because the skill effectively imposes a specific language/locale by default.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The entire markdown document, including headings, instructions, comments, and checklist items, is written in Chinese with no indication that another language is supported or that the locale restriction is intentional for a region-specific use case. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The header comments and user-facing output strings are written exclusively in Chinese, including the script description and usage guidance. This creates a language/locale constraint in the skill's natural-language interface without any opt-in, alternative language, or justification that the tool is region-specific.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.