python 查询技能

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:54 AM UTC
• Version: 1.0.0

Overview

The skill appears to perform its stated database query task, but it should be reviewed because it uses SQL Server credentials and does not enforce verified encrypted database connections.

Before installing, treat this as a database-accessing skill: use a dedicated least-privileged SQL account limited to the required stored procedure, store credentials in a protected environment rather than shared shell profiles, restrict network access to the intended SQL Server, and require a modern ODBC driver with verified TLS. Rotate the password if it has been used over an untrusted network.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: commands/query.py:51

Finding

SQL Server Connection Does Not Enforce Verified Encryption

Content

View full analysis

Vulnerability Details

File Location: commands/query.py, lines 51-58
Vulnerability Type: Insecure transport of database credentials and business data
Risk Level: Medium

python

def connect_to_db() -> pyodbc.Connection:
    """返回一个新的 pyodbc 连接"""
    conn_str = (
        f"DRIVER={{SQL Server}};"
        f"SERVER={SQL_SERVER};"
        f"DATABASE={SQL_DATABASE};"
        f"UID={SQL_USER};"
        f"PWD={SQL_PASSWORD}"
    )
    return pyodbc.connect(conn_str, timeout=30)

Technical Analysis

The Skill must connect to SQL Server to provide its declared passenger-flow query functionality, so network access and use of database credentials are functionally necessary. However, the connection string uses the legacy generic SQL Server driver and does not explicitly require TLS encryption or server-certificate validation.

The absence of settings such as Encrypt=yes and TrustServerCertificate=no means the code does not guarantee that credentials, query parameters, and returned records are protected by authenticated encryption. The server destination is also taken from the MY_SQL_SERVER environment variable without application-level destination validation.

This is an insecure coding and configuration issue rather than evidence of intentional exfiltration. The reviewed code does not send data to any hardcoded attacker-controlled service.

Attack Path

1. An attacker obtains a network interception position between the Skill host and the configured SQL Server, or gains the ability to alter the MY_SQL_SERVER environment variable.
2. The Skill invokes connect_to_db() while processing a passenger-flow query.
3. The client opens a database connection without explicitly requiring verified TLS.
4. Depending on the installed driver and server configuration, the attacker may observe or manipulate database traffic, or redirect the connection toward an unintended server.
5. Database credenti ...[truncated 845 chars]

Remediation

View remediation

Remediation Suggestions

1. Use a currently supported Microsoft SQL Server ODBC driver, such as ODBC Driver 18.

2. Require encrypted transport and certificate validation:

   python

   conn_str = (
       "DRIVER={ODBC Driver 18 for SQL Server};"
       f"SERVER={SQL_SERVER};"
       f"DATABASE={SQL_DATABASE};"
       f"UID={SQL_USER};"
       f"PWD={SQL_PASSWORD};"
       "Encrypt=yes;"
       "TrustServerCertificate=no;"
   )
   

3. Configure the SQL Server with a certificate issued by a trusted authority whose hostname or subject alternative name matches the configured server.

4. Do not use TrustServerCertificate=yes as a permanent workaround, because it encrypts traffic without securely authenticating the destination.

5. Restrict outbound network access so the Skill can connect only to the approved SQL Server host and port.

6. Validate the configured server against an administrator-controlled allowlist where deployment requirements permit it.

7. Use a dedicated least-privileged database account authorized only to connect to the required database and execute openclaw_fetch_zwc_keliu.

8. Rotate the database password if there is evidence that the Skill was previously used over an untrusted network.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README instructs users to place the SQL Server connection address, database name, username, and password into environment variables, but provides no warning about secure secret handling, rotation, or avoiding accidental disclosure through logs, screenshots, exports, or shared shell profiles. While using environment variables is common, documenting credential use without any security guidance increases the risk of credential exposure in operational use.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The natural-language content in the description, title, usage, examples, and parameter help is exclusively Chinese. This can violate a language/locale policy when the skill forces a specific language without giving the user an option to choose another language or documenting a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code reads database server, username, and password values from environment variables and then uses them to establish a live database connection. Although the module docstring documents the variables for operators, there is no user-facing warning, confirmation, or visible disclosure that the skill accesses sensitive credentials and queries an external database.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.