Skill

database-security

skill:zhaoxuya520/reverse-skill#database-security

Use for authorized database security assessment covering PostgreSQL/MySQL/MSSQL/Mongo/Redis exposure, authz, UDF/command paths, and misconfiguration review.

skills.sh SkillsMP

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 21:15 UTC at cab634b

findings

medium

highest severity

threat classes

632

files scanned

24/24

checks satisfied

package advisories

Why this verdict

suspicious: finding skill:skills/database-security:skills/database-security/SKILL.md:10:HIJACK
suspicious: finding skill:skills/database-security:skills/database-security/SKILL.md:45:HIJACK
suspicious: finding skill:skills/database-security:skills/database-security/SKILL.md:50:HIJACK

Security findings 3

Agent hijacking

mediumContextual riskmedium confidence

The database-security skill's 'ACTION REQUIRED (execute immediately after reading)' section unconditionally mandates that the agent immediately read the 'precedent-pentest' skill as step 1, whose content is not part of the consumed artifact, injecting an unreviewable runtime instruction source into the declared assessment workflow.

skills/database-security/SKILL.md:10

1. `NOW`: 读取 precedent-pentest

vector:instruction

Counter-argument considered

Step 1 under the immediate-execution header is an explicit, unconditional mandate to load a skill named precedent-pentest that lies outside the target root; the declared description covers only database assessment, no carve-out fits, and the inline production-DB caution does not neutralize the external instruction load. Refutation would require evidence that the load is declared, benign, or mitigated, and none is shown.

Agent hijacking

mediumContextual risklow confidence

The skill's references section directs the agent to the sibling directories '../pentest-tools/' and '../cloud-k8s/', which exist but are outside the consumed artifact, so consulting them loads unreviewable runtime content.

skills/database-security/SKILL.md:45

- `../pentest-tools/` `../cloud-k8s/`

vector:instruction

Counter-argument considered

The references section does point the agent at sibling directories outside the consumed artifact, so consulting them loads unreviewed runtime content, and no carve-out or mitigation covers this; the directories' existence is unverified from shown evidence, but an absent file never neutralizes a read instruction, so this cannot refute the finding.

Agent hijacking

mediumContextual riskmedium confidence

The skill's routing context wires the agent into sibling skills - upstream 'MASTER R35', and conditionally 'attack-chain' upon obtaining OS command access and 'cloud-k8s' for cloud-managed findings - none of which are part of the consumed artifact, extending the agent's runtime instruction chain to unreviewable content.

skills/database-security/SKILL.md:50

**下游**: 获 OS 命令 → attack-chain；云托管 → cloud-k8s

trigger:conditionalvector:instruction

Counter-argument considered

The routing-context line conditionally wires the agent into sibling skills (attack-chain on obtaining OS command access, cloud-k8s for cloud-managed findings, upstream MASTER R35) outside the consumed artifact; open labeling in a routing section is not a declared claim, no carve-out applies, and no shown evidence neutralizes the chain extension.

Open questions 6

What the analysis could not settle from the code alone.

[file request skills/precedent-pentest/SKILL.md] The 'ACTION REQUIRED' section (read immediately upon loading) directs the agent to read 'precedent-pentest' as step 1; does that referenced file contain instructions that steer the agent beyond the declared database-security assessment, override user instructions, or add hidden directives?

Agent hijacking

[file request skills/pentest-tools/SKILL.md] The skill's reference section points the agent at the sibling directory ../pentest-tools/; does the referenced sibling skill ship instructions or auto-run scripts that go beyond the declared assessment workflow?

Code execution

[file request skills/cloud-k8s/SKILL.md] This skill is referenced as a downstream route (cloud-managed findings) and in the references section; does its content steer the agent beyond the declared database-security task?

Reconnaissance

[file request skills/attack-chain/SKILL.md] The routing-context section sends the agent to 'attack-chain' when OS command access is obtained from the database; does that downstream skill contain instructions that extend or alter the agent's behavior beyond the declared assessment?

Code execution

[file request skills/MASTER/SKILL.md] The routing-context section names 'MASTER R35' as the upstream router; is that a skill in this repository whose instructions the agent will follow, and do those instructions contain directives beyond the declared task?

Agent hijacking

[file request skills/precedent-pentest/SKILL.md] What instructions does precedent-pentest give the agent when loaded as mandated by the database-security skill's ACTION REQUIRED step, and do they add capabilities beyond the declared authorized database security assessment?

Agent hijacking