Security audit

chatbi-skil-test

Security checks for vulnerabilities and agentic risk

Overview

This ChatBI skill matches its stated data-query purpose, but it can send enterprise questions and embedded workspace/account context to a production HTTP endpoint with broad activation and limited privacy warnings.

Install only if you trust the configured ChatBI service and are authorized to query the embedded workspace and tables. Prefer configuring an approved HTTPS endpoint and your own account/workspace variables, avoid sensitive or regulated data unless approved, and do not use raw mode or --save-raw unless you can protect and clean up the resulting logs/files.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The activation text is broad enough to trigger on generic requests such as database querying, data analysis, or SQL analysis, rather than narrowly scoping invocation to ChatBI-specific use cases. That can cause the skill to be invoked unexpectedly on unrelated prompts, increasing the chance that enterprise data queries are sent to a remote service or that SQL generation/execution occurs without clear user intent.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill description does not clearly warn users that natural-language prompts may be transmitted to a remote ChatBI service and may result in generated and executed SQL against enterprise datasets. In this context, missing disclosure is dangerous because users may unknowingly send sensitive business questions or cause access to regulated/internal data without informed consent.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The CLI can persist raw SSE events to an arbitrary file via --save-raw, and those events may contain sensitive business queries, generated SQL, schema hints, intermediate reasoning artifacts, or returned data. Because this is a data-querying skill for enterprise tables, saving raw events without an explicit warning, confirmation, or redaction control creates a realistic confidentiality risk if operators store files on shared disks, commit them accidentally, or leave them in insecure locations.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The documented raw output mode is intended for debugging, but it exposes complete event content to stdout without any privacy warning or masking. In this skill's context, raw events may include internal tool metadata, query text, SQL, and potentially sensitive enterprise data, so printing them to terminals, logs, CI output, or shell history pipelines can leak confidential information beyond the intended operator.

Static analysis

No suspicious patterns detected.