DBQ — 多数据库查询助手

• Outcome: Review
• Latest audit: Jul 9, 2026 · 9:59 PM UTC
• Version: 1.4.0

Overview

This database skill is not malicious, but it needs Review because it can let agents run write and schema-changing SQL, bypass confirmations, and expose local database credentials.

Install only if you will configure least-privilege database accounts and keep production connections read-only by default. Avoid DB_QUERY_ASSUME_YES=1 for production, avoid --keychain-get, review local SQL logs for sensitive values, and treat write/DDL aliases as admin-level tools.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill documents shell execution, file read/write, and environment-variable use, but declares no permissions or capability boundaries. In a database-management skill that can target dev/test/prod and manipulate config files, this omission weakens user awareness and enforcement around sensitive operations and increases the chance of unsafe invocation or privilege overreach.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: The README markets the tool as 'read-only by default' and 'security-first', but the documented behavior clearly enables INSERT/UPDATE/DELETE and DDL operations through configuration. That mismatch is dangerous because an AI agent or user may rely on the safer framing while still being guided toward destructive database actions, especially across prod environments.

Description-Behavior Mismatch

High

• Confidence: 92% confidence
• Finding: The skill markets itself as read-only and security-first, but the CLI explicitly supports DML and DDL execution, including DELETE, UPDATE, INSERT, and schema operations. That mismatch can cause operators or downstream agents to trust the tool with production access under false assumptions, increasing the risk of destructive or unauthorized database changes.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation explicitly recommends DB_QUERY_ASSUME_YES=1 to suppress production write confirmations for non-interactive or AI agent use. In agent contexts, this removes an important human safety barrier and increases the chance of unintended destructive writes being executed automatically.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The example section provides ready-to-run INSERT, UPDATE, DELETE, ALTER, and CREATE INDEX commands in AI mode using DB_QUERY_ASSUME_YES=1, but does not surround them with strong warnings about irreversible effects. In practice, these examples normalize autonomous destructive execution and may be copied directly into prod or other sensitive environments.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README repeatedly demonstrates destructive operations with `DB_QUERY_ASSUME_YES=1` in AI-agent/non-interactive mode, which bypasses the documented interactive prod confirmation. In a tool explicitly designed for AI assistants, failing to prominently warn that confirmations can be skipped materially increases the chance of unintended or automated destructive writes, especially against production aliases.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README states that all SQL, including EXPLAIN statements, is automatically logged to local files, but it does not clearly warn that queries may contain sensitive business data, identifiers, or secrets embedded in SQL text. In an AI-agent context, this is more dangerous because prompts and generated queries may include sensitive conditions or copied values, creating an unintended local data trail.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The keychain retrieval helper prints the resolved password directly to stdout, which can expose credentials to terminal history capture, shell pipelines, logs, calling agents, or other local observers. In an agent skill context, this is especially risky because the secret may be returned verbatim to an upstream model or orchestration layer that should not receive raw database credentials.

Credential Access

High

• Category: Privilege Escalation

Content

if not alias:
        print("[ERROR] 请提供别名: --keychain-set <别名>", file=sys.stderr)
        sys.exit(1)
    service = _keychain_service(env, alias)
    pwd = getpass.getpass(f"请输入 [{alias}] ({env}) 密码: ")
    subprocess.run(
        [

• Confidence: 74% confidence
• Finding: The function captures a database password and then passes it to an external process via the command-line argument list ('-w', pwd). Even without shell injection, supplying secrets on a process command line can expose them to local process inspection tools, audit frameworks, or system logs on some platforms, creating a credential disclosure risk.

Static analysis

No suspicious patterns detected.