flydb-cli-release

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:04 AM UTC
• Version: 1.0.2

Overview

This is a coherent Flydb CLI helper, but it asks the agent to run downloaded database tooling and dynamically loaded JDBC code without mandatory independent verification.

Review before installing. Prefer an already-installed or locally supplied Flydb CLI whose ZIP hash or signature you can verify independently. Avoid using the Gitee/GitHub download path unless you trust that release channel and the exact version. For JDBC drivers, prefer approved local or internal-repository artifacts, consider setting driver-download=never or offline for agent-run operations, and use least-privileged database accounts. Keep production writes behind dry-run/plan review and explicit approval, and do not store real passwords in config files or shared logs.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/release-package.md:47

Finding

Unverified Remote Executable Download and Execution

Content

View full analysis

/flydb-cli-.zip ``` The bundled provenance record does not establish binary authenticity: ```json { "source_repository": "https://github.com/zzxCoding/Flydb", "source_commit": "56bc3baef4a4e5c9eefe440644a4343aa960d0a4", "source_version": "0.3.6", "source_inputs_dirty": false, "source_input_status": [], "release_status": "not_verified" } ``` ### Technical Analysis The Skill directs the Agent to download a ZIP containing POSIX and Windows launchers and Java runtime JARs from personally controlled GitHub or Gitee repositories, extract it, and run `bin/flydb`. The documented `unzip -t` operation only checks whether the ZIP is structurally valid. It does not authenticate the publisher or prove that the archive matches reviewed source code. SHA-256 verification is conditional on a checksum being available from the same Release, and the Skill does not bundle a trusted binary digest or pinned signing key. A checksum retrieved from the same compromised rel ...[truncated 2248 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: references/configuration.md:71

Finding

Automatic Download and Dynamic Loading of Unpinned JDBC JARs

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (23)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md

| [`references/commands.md`](references/commands.md) | 选择子命令、核对全局选项与参数语义 |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

md

| [`references/commands.md`](references/commands.md) | 选择子命令、核对全局选项与参数语义 |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.

md

| [`references/commands.md`](references/commands.md) | 选择子命令、核对全局选项与参数语义 |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md

| [`references/configuration.md`](references/configuration.md) | 配置键、环境变量、优先级、版本选择/路径过滤规则 |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md

| [`references/jdbc-integration.md`](references/jdbc-integration.md) | 新数据库接入、驱动与方言区别、SPI JAR 与厂商验证边界 |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md

| [`references/web.md`](references/web.md) | 启动本机 GUI、管理原配置、查看进度和同机 CLI 记录 |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

md

| [`references/web.md`](references/web.md) | 启动本机 GUI、管理原配置、查看进度和同机 CLI 记录 |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md

| [`references/web-api.md`](references/web-api.md) | 直接调用本机 API、配置冲突、确认引用、Run/SSE 状态 |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md

| [`references/json-output.md`](references/json-output.md) | CI/Agent 读取机器信封、protocolVersion、错误与状态 token |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/web-api.md (reported line 26)May include surrounding context.

md

| `GET /api/discover?path=…` | 有界发现配置文件，返回 files 和扫描限制信息 |
| `POST /api/profiles` | mode 为 import/create/discover/duplicate；返回登记数组 |
| `PUT /api/profiles/:id` | name/group/environment/workingDirectory，可选 driversDirectory |
| `DELETE /api/profiles/:id` | 只移除登记 |
| `GET /api/profiles/:id/config` | revision/values/effective/sources/secretKeys，可含配置 error |
| `PUT /api/profiles/:id/config` | `{revision, values:{key:string或null}}` 或 `{revision, content}`；整文件保存强制校验，返回脱敏快照 |
| `POST /api/profiles/:id/actions` | 提交预定义操作，返回 Run |

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description is written entirely in Chinese and the document consistently instructs in Chinese, with no indication that users may choose another language. Per the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This file contains user-facing natural-language content exclusively in Chinese across prompts, assertions, and expected outputs. Under the policy rule, forcing a specific language without opt-in is a natural-language locale policy issue, and the file does not offer alternatives or explain that the skill is region-specific.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · evals/evals.json (reported line 105)May include surrounding context.

json

"assertions": [
        "不直接重跑或 repair",
        "不把 confirmed=800 当作已提交 800 条",
        "不套用 nohup 进程仍存活的结论"
      ]
    },
    {

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · evals/evals.json (reported line 110)May include surrounding context.

json

"assertions": [
        "不直接重跑或 repair",
        "不把 confirmed=800 当作已提交 800 条",
        "不套用 nohup 进程仍存活的结论"
      ]
    },
    {

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/commands.md (reported line 132)May include surrounding context.

md

"assertions": [
        "不直接重跑或 repair",
        "不把 confirmed=800 当作已提交 800 条",
        "不套用 nohup 进程仍存活的结论"
      ]
    },
    {

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This markdown file is written entirely in Chinese and presents the contract and usage requirements in that language only. Under the stated policy, forcing a specific language without user opt-in or a clearly documented region-specific justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/upstream-sync.json (reported line 74)May include surrounding context.

json

"sha256": "fb6abb9bb136c2f135da833f5fde72f0fb21bfd8b4808d74f6f1a30866e9a7c7"
    },
    {
      "source": "flydb-skills/skills/flydb-cli/SKILL.md",
      "sha256": "5e8a4bd8d85ffae9b7edde49d92ba20a10d2c2df1579151bc76f2d5cb380b7cb"
    },
    {

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

该 markdown 文件面向技能使用者的自然语言说明从标题开始即全部为中文，没有提供其他语言选项，也未说明该文档仅适用于特定中文用户群或区域。按规则，强制特定语言而无用户选择或明确合理性说明，属于自然语言层面的语言/locale 策略问题。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

该文件是面向用户的参考文档，全文以中文呈现，但没有说明这是特定区域/语言版本，也未提供用户可选语言或英文对照。按规则，未经过用户选择而强制单一语言属于自然语言层面的语言/区域策略问题。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file presents all operational instructions exclusively in Chinese, and there is no note offering alternate languages or indicating that the skill is intentionally limited to Chinese-speaking users. Under the language/locale policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This JSON manifest contains a natural-language instruction in Chinese ("按 commands.md 补充 web 不支持 --json 的例外") while the file otherwise uses neutral metadata fields and does not indicate that the skill is intended to operate in a Chinese-only context. That can violate language/locale policy because it implicitly forces one language for maintainers or reviewers without opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The adaptation entry at L58 uses Chinese-only natural language ("历史 ZIP 示例改用已核验的 FLYDB_VERSION") with no indication that the repository or skill is region-specific. Without user or maintainer language choice, this creates the same language-policy concern as other localized-only instructions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

标题及整篇说明均以中文撰写，但文档中没有说明这是面向特定中文区域用户的限定，也没有提供用户可选择其他语言的表述。按规则，未提供 opt-in 的固定语言要求属于自然语言层面的 locale policy 风险。

Content

No source excerpt is available for this finding.