Security audit

SQL Data Analyst

Security checks across malware telemetry and agentic risk

Overview

The skill is a disclosed local data-analysis runner with metered platform authorization, and I found no hidden data upload or destructive behavior outside its local workspace.

Install only if you are comfortable with a paid local runner that stores normalized copies and reports in its OpenClaw workspace, uses SQL_DATA_ANALYST_API_KEY for platform authorization, and sends billing metadata but not raw data. Avoid running it on untrusted files until the pyarrow pin is updated, and treat the delete command as irreversible cleanup of the local dataset copy.

SkillSpector

By NVIDIA

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill advertises local data analysis but declares no explicit permissions while documentation indicates access to environment variables, local files, report output, and remote network services. Missing permission disclosure weakens least-privilege review and can cause users to grant or tolerate broader capabilities than they realize.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The documented purpose is purely local read-only analysis, but the skill also depends on remote platform connectivity, API-key authentication, and licensing/billing flows. This behavior mismatch can mislead users about trust boundaries and may cause sensitive metadata or user actions to be exposed to a remote service contrary to expectations.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: Requiring a platform API key while asserting that analysis, SQL, and results stay local creates a trust-gap: users may assume no meaningful platform dependency exists when remote authentication is in fact mandatory. Even if raw datasets are not uploaded, authentication and usage metadata can still reveal sensitive operational details and expand the attack surface.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The API authorizes a destructive operation, `dataset.delete`, even though the skill is presented as a local analysis tool for read-only SQL and report generation. This creates a capability mismatch: an agent or runner granted access for benign analytics could obtain valid authorization for deleting local datasets, increasing the risk of unintended or abusive data destruction.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: Including dataset deletion in a skill advertised for read-only local SQL/data analysis violates the principle of least privilege. In this context, the hidden destructive capability is especially dangerous because users and orchestrators may trust the skill to be non-mutating, making accidental or unauthorized deletions more likely.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The CLI exposes a destructive `delete` operation even though the skill description emphasizes local data analysis, read-only SQL, and report generation. That mismatch increases the risk that an orchestrator or user invokes the skill with an incorrect trust model, causing unintended permanent dataset removal.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: Paid operations call a platform authorizer and load API credentials from the environment, which introduces network interaction and secret usage not implied by a 'local analysis' skill description. This can violate user expectations, expand the attack surface, and risk unintended disclosure of metadata such as operation type, dataset identifiers, and input fingerprints to a remote service.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The `delete` command performs destructive removal without any warning, confirmation, or friction in this CLI flow. In a data-analysis tool, that makes accidental or misrouted invocation materially dangerous because users may assume operations are read-only.

Known Vulnerable Dependency: pyarrow==21.0.0 — 2 advisory(ies): CVE-2026-25087 (Apache Arrow: Potential use-after-free when reading IPC file with pre-buffering); CVE-2026-25087 (Use After Free vulnerability in Apache Arrow C++. This issue affects Apache Arr)

High

Category: Supply Chain
Confidence: 95% confidence
Finding: The project pins pyarrow==21.0.0, and the supplied advisory indicates a use-after-free in Apache Arrow when reading IPC data. This skill explicitly handles local analytical data formats including Parquet, so a vulnerable Arrow library is directly in the attack surface if an analyst opens a malicious file, potentially causing crashes or memory-corruption-driven code execution in the local runtime.

Known Vulnerable Dependency: pyarrow==21.0.0 — 2 advisory(ies): CVE-2026-25087 (Apache Arrow: Potential use-after-free when reading IPC file with pre-buffering); CVE-2026-25087 (Use After Free vulnerability in Apache Arrow C++. This issue affects Apache Arr)

High

Category: Supply Chain
Confidence: 97% confidence
Finding: The lockfile pins pyarrow==21.0.0, and the supplied advisory identifies a use-after-free in Apache Arrow when reading IPC data with pre-buffering. In the context of this skill, which explicitly analyzes local CSV/JSON/XLSX/Parquet data, PyArrow is plausibly reachable through Parquet/Arrow ingestion, so opening a crafted local file could trigger memory corruption, potentially causing a crash or enabling code execution depending on exploitability.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.