data-query

• Outcome: Review
• Latest audit: May 28, 2026 · 2:22 PM UTC
• Version: 1.0.0

Overview

The skill’s SQL dashboard purpose is coherent, but it ships live-looking database and API credentials that could grant access to external business data.

Install only in an environment where the included ACM database/API endpoints and credentials are intended to be used. Rotate or remove the shipped credentials, prefer environment variables or a secrets manager, restrict the database/API account to read-only tenant-scoped access, and review generated HTML before deployment because it can execute embedded SQL through the backend and reuse browser session tokens.

SkillSpector

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

)

        try:
            subprocess.check_call(f'{editor} "{fname}"', shell=True)
        except FileNotFoundError as e:
            if not e.filename:
                e.filename = editor

• Confidence: 98% confidence
• Finding: The code builds a shell command from the editor value and executes it with shell=True: subprocess.check_call(f'{editor} "{fname}"', shell=True). The editor value can come from a CLI option or from the VISUAL/EDITOR environment variables, so an attacker who can influence those inputs can inject arbitrary shell metacharacters and achieve command execution; quoting only fname does not make the overall command safe.

exec() call detected

High

• Category: Dangerous Code Execution

Content

# This empty dict will contain the namespace for the exec'd file
        custom_namespace = {}
        with open(filename, 'rb') as f:
            exec(f.read(), custom_namespace)
        # Retrieve the class `formattername` from that namespace
        if formattername not in custom_namespace:
            raise ClassNotFound(f'no valid {formattername} class found in {filename}')

• Confidence: 99% confidence
• Finding: This function reads a Python file and executes its contents with exec(), which enables arbitrary code execution if the filename or file contents can be influenced by an attacker. The docstring explicitly acknowledges it is equivalent to eval(), so any use on untrusted files would fully compromise the process.

exec() call detected

High

• Category: Dangerous Code Execution

Content

# This empty dict will contain the namespace for the exec'd file
        custom_namespace = {}
        with open(filename, 'rb') as f:
            exec(f.read(), custom_namespace)
        # Retrieve the class `lexername` from that namespace
        if lexername not in custom_namespace:
            raise ClassNotFound(f'no valid {lexername} class found in {filename}')

• Confidence: 99% confidence
• Finding: load_lexer_from_file() reads a file and executes its contents with exec(), which is arbitrary code execution if an attacker can influence the filename or file contents. The docstring explicitly acknowledges this risk, but that does not reduce the danger: in any agent or data-query context where user-controlled paths or uploaded files could reach this function, exploitation would lead to full code execution in the process.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution, suspicious.env_credential_access (+2 more)

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/generate/validate_page.js:284

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: venv_dm/lib/python3.14/site-packages/pip/_vendor/pygments/formatters/__init__.py:91

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: src/generate/page.js:76

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: src/verify/index.js:620

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: CHANGES.md:79

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: src/verify/index.js:247

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: templates/cockpit_template.html:671

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: templates/html_page_template.html:371

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: venv_dm/lib/python3.14/site-packages/pip/_internal/network/auth.py:97

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: venv_dm/lib/python3.14/site-packages/pip/_vendor/requests/adapters.py:257

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: venv_dm/lib/python3.14/site-packages/pip/_vendor/requests/sessions.py:322

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: venv_dm/lib/python3.14/site-packages/pip/_vendor/urllib3/connection.py:423

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: venv_dm/lib/python3.14/site-packages/pip/_vendor/urllib3/connectionpool.py:991

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: venv_dm/lib/python3.14/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.py:231

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: venv_dm/lib/python3.14/site-packages/pip/_vendor/urllib3/contrib/socks.py:102

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: src/generate/page.js:726

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: venv_dm/lib/python3.14/site-packages/pip/_internal/network/session.py:312

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: venv_dm/lib/python3.14/site-packages/pip/_vendor/truststore/_macos.py:371

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: venv_dm/lib/python3.14/site-packages/pip/_vendor/truststore/_windows.py:458

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: venv_dm/lib/python3.14/site-packages/pip/_vendor/urllib3/connection.py:454

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: venv_dm/lib/python3.14/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.py:113

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: venv_dm/lib/python3.14/site-packages/pip/_vendor/urllib3/contrib/securetransport.py:794

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: venv_dm/lib/python3.14/site-packages/pip/_vendor/urllib3/util/ssl_.py:140