Skill

hsql

skill:tconbeer/harlequin#skill

Run SQL against any database from the command line with hsql, Harlequin's headless SQL client — execute a query or a .sql file, inspect a database's schemas, tables and columns, read the history of queries run against it, export results as CSV/JSON/Parquet, and read or write harlequin.toml profiles. Covers DuckDB, SQLite, Postgres, MySQL and other Harlequin adapters. Use whenever the work involves running SQL, finding out what is in a database, checking a connection string or DSN, a .sql file, or a config file for a database connection — including when the user never says "hsql" or "harlequin".

SkillsMP

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 22:37 UTC at ad3ecef

findings

critical

highest severity

threat classes

451

files scanned

143/145

checks satisfied

package advisories

Why this verdict

suspicious: finding plugin:src/harlequin/hsql/skill:src/harlequin/hsql/skill/references/sessions.md:112:PERSIST
suspicious: unverified finding plugin:src/harlequin/hsql/skill:src/harlequin/hsql/skill/references/troubleshooting.md:101:CRED

Security findings 2

Persistence

criticalContextual riskmedium confidence

The sessions reference instructs the agent to write a SessionStart hook into the agent control-plane file .claude/settings.json whose command launches `setsid hsql --serve dev -P dev` as a detached background daemon logging to /tmp, auto-starting a standing authenticated database connection on every agent session with no idle timeout.

src/harlequin/hsql/skill/references/sessions.md:112

setsid hsql --serve dev -P dev >>/tmp/hsql-dev.log 2>&1 &

vector:instruction

Counter-argument considered

The shipped section hands the agent a complete SessionStart hook for the agent's own control plane that relaunches a detached, credential-bearing daemon at every session; .claude/settings.json appears in no declared claim (the description covers only harlequin.toml profiles), and the 'propose rather than write unasked' guardrail lowers severity but does not neutralize the persistence pattern, which has no validation or cleanup path and matches no carve-out.

Credential access

highUnverifiedlow confidence

The skill's troubleshooting guidance directs users to redirect `hsql --info` output to a file and publish it in a public bug report based solely on a documented claim that profile secrets are masked, which no shipped code in the artifact verifies, so incomplete redaction in the hsql implementation would leak database credentials into the published report.

src/harlequin/hsql/skill/references/troubleshooting.md:101

so it is safe to paste into a bug report

vector:instruction

Open questions 2

What the analysis could not settle from the code alone.

The same SessionStart hook example runs hsql with stderr discarded ('hsql --session dev --session-status >/dev/null 2>&1'), while the artifact's own mandatory rule (D33) says 'Never write 2>/dev/null'; the hook consumes only the exit code, so this is either an accepted exception or an internal contradiction between the artifact's safety rule and its example — undecidable from the shown evidence.

[file request src/harlequin/hsql] Do hsql's `--info` and `--config show` outputs actually mask secret profile values (passwords and adapter-declared secrets) as the skill claims, so that redirecting them to files (e.g. `hsql --info > info.json`, 'safe to paste into a bug report') cannot leak database credentials?

Credential access

Coverage gaps 13

Parts of the artifact the static analysis could not fully examine.

context:unanalyzable_binary pe content is only byte-scanned

tests/data/adapter_tests/sqlite/extensions/hello0.dll

context:unanalyzable_binary macho content is only byte-scanned

tests/data/adapter_tests/sqlite/extensions/hello0.dylib

context:unanalyzable_binary elf content is only byte-scanned

tests/data/adapter_tests/sqlite/extensions/hello0.so

context:unanalyzable_binary binary content is only byte-scanned

tests/data/catalog-cache-2.pickle

context:unanalyzable_binary pe content is only byte-scanned

tests/data/unit_tests/sqlite_extension/hello0.dll

context:unanalyzable_binary macho content is only byte-scanned

tests/data/unit_tests/sqlite_extension/hello0.dylib

context:unanalyzable_binary elf content is only byte-scanned

tests/data/unit_tests/sqlite_extension/hello0.so

context:manifest_unparseable toml: Cannot declare ('keymaps', 'more_arrows') twice (at line 6, column 21)

tests/data/unit_tests/config/keymaps_not_array.toml

context:manifest_unparseable toml: Expected '=' after a key in a key/value pair (at line 1, column 6)

tests/data/unit_tests/config/not_toml.toml

ledger_finding_without_valid_finding run 1: instruction-surface.0 SRC:15f8bb6e3a349f9b

ledger_finding_without_valid_finding run 1: declared-vs-actual.0 SRC:15f8bb6e3a349f9b

invalid_judge_finding instruction-surface.0

invalid_judge_finding declared-vs-actual.0