Security audit

SQLBot

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it claims, but its dashboard export path handles SQLBot authentication too broadly and should be reviewed before installation.

Review this skill before installing. It requires SQLBot API credentials, can switch the active SQLBot workspace, query datasources and chats, read dashboard data, save local context, and write dashboard exports. Avoid using dashboard export with untrusted dashboard content or non-isolated networks until auth headers are scoped to the SQLBot origin, and consider pinning Playwright/Chromium and protecting the .env file.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: sqlbot_skills.py:865
Finding: SQLBot Authentication Token Disclosed to Cross-Origin Resources During Dashboard Export
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:23
Finding: Unpinned Playwright and Chromium Installation Creates a Supply-Chain Risk
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (20)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 125)May include surrounding context.
bash
python3 sqlbot_skills.py workspace list python3 sqlbot_skills.py --env-file ./.env workspace list

切换工作空间：

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · sqlbot_skills.py (reported line 202)May include surrounding context.
python
```bash python3 sqlbot_skills.py workspace list python3 sqlbot_skills.py --env-file ./.env workspace list ``` 切换工作空间：

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · sqlbot_skills.py (reported line 204)May include surrounding context.
python
```bash python3 sqlbot_skills.py workspace list python3 sqlbot_skills.py --env-file ./.env workspace list ``` 切换工作空间：

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · sqlbot_skills.py (reported line 206)May include surrounding context.
python
```bash python3 sqlbot_skills.py workspace list python3 sqlbot_skills.py --env-file ./.env workspace list ``` 切换工作空间：

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · sqlbot_skills.py (reported line 266)May include surrounding context.
python
```bash python3 sqlbot_skills.py workspace list python3 sqlbot_skills.py --env-file ./.env workspace list ``` 切换工作空间：

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · sqlbot_skills.py (reported line 1154)May include surrounding context.
python
```bash python3 sqlbot_skills.py workspace list python3 sqlbot_skills.py --env-file ./.env workspace list ``` 切换工作空间：

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 95)May include surrounding context.
Create .env next to SKILL.md:

bash
cp .env.example .env

Minimum required fields:

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · reference.md (reported line 28)May include surrounding context.
Create .env next to SKILL.md:

bash
cp .env.example .env

Minimum required fields:

Lp1

High

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill uses 'file_write' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill uses 'network' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · sqlbot_skills.py (reported line 20)May include surrounding context.
python
from urllib.request import HTTPCookieProcessor, OpenerDirector, Request, build_opener API_PREFIX = "/api/v1" DEFAULT_ENV_FILE = ".env" DEFAULT_STATE_FILE = ".sqlbot-skill-state.json" DEFAULT_DASHBOARD_EXPORT_FORMAT = "jpg" SCREENSHOT_EXPORT_FORMATS = {"jpg", "jpeg", "png"}

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 85% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.md (reported line 50)May include surrounding context.
如果你要把它安装成 Claude Code Skill，可以直接复制整个目录：

bash
mkdir -p ~/.claude/skills/sqlbot-workspace-dashboard cp -R /path/to/SQLBot-skills/* ~/.claude/skills/sqlbot-workspace-dashboard/

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 85% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · reference.md (reported line 53)May include surrounding context.
如果你要把它安装成 Claude Code Skill，可以直接复制整个目录：

bash
mkdir -p ~/.claude/skills/sqlbot-workspace-dashboard cp -R /path/to/SQLBot-skills/* ~/.claude/skills/sqlbot-workspace-dashboard/

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 50)May include surrounding context.
如果你要把它安装成 Claude Code Skill，可以直接复制整个目录：

bash
mkdir -p ~/.claude/skills/sqlbot-workspace-dashboard cp -R /path/to/SQLBot-skills/* ~/.claude/skills/sqlbot-workspace-dashboard/

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · reference.md (reported line 25)May include surrounding context.
Required configuration

Create .env next to SKILL.md:

bash
cp .env.example .env

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 85% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · reference.md (reported line 60)May include surrounding context.
Project skill:

bash
mkdir -p .claude/skills/sqlbot-workspace-dashboard cp -R /path/to/SQLBot-skills/* .claude/skills/sqlbot-workspace-dashboard/

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The local storage initialization hard-codes user.language to zh-CN, which imposes a specific locale on users regardless of their preference. This is a natural-language policy concern because the file does not offer a language choice or document a justified region-specific restriction.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This markdown file describes that switching the current datasource updates a skill-local state file, which affects local user data and future skill behavior. While persistence is mentioned later in the Notes section, the operation description itself does not warn users up front that invoking the switch will write local state.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill silently persists workspace and datasource context to a local state file, which can surprise users and leak operational context to other local users or processes. While it does not store API secrets, hidden persistence still creates a privacy and safety issue in shared environments.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Dashboard export writes files to a caller-supplied path and creates parent directories without warning, which can overwrite or create files unexpectedly. In agent contexts, unannounced file creation can have side effects on the host filesystem and may expose exported data if written to unsafe locations.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Lp1

Lp1

Credential Access

Skill Enumeration

Skill Enumeration

Session Persistence

Session Persistence

Required configuration

Skill Enumeration

Natural-Language Policy Violations

Missing User Warnings

Missing User Warnings

Missing User Warnings

Static analysis