Run safe read-only queries against MySQL or PostgreSQL for data inspection, reporting, and troubleshooting. Use when the user asks to read tables, inspect schema, count rows, sample data, or export query results without modifying data.

This skill appears to do what it claims (run read-only queries), but the package metadata failing to declare the required DB environment variables is a red flag — the skill will require your DB credentials even though that isn't advertised. Before installing or using it: (1) require the publisher to update metadata to list required env vars and clarify how secrets are handled; (2) only run against non-production or read-only accounts; create and use a DB user with minimal read-only privileges and limited schemas; (3) inspect and test the script in an isolated environment — note it exports PGPASSWORD/MYSQL_PWD which can be exposed by some system tools; prefer client-side auth methods (.pgpass, socket auth, or IAM-based short-lived creds) if available; (4) be cautious when using --out (files may contain sensitive data) and avoid running complex user-provided SQL without review; and (5) if you must proceed, run the script on a guarded workstation/network and validate output before sharing. If the author cannot justify the missing metadata or confirm safe handling of credentials, treat the skill as untrusted.

Type: OpenClaw Skill Name: db-readonly Version: 1.0.0 The skill is classified as suspicious primarily due to the arbitrary file write capability in `scripts/db_readonly.sh`. The `--out` parameter allows writing database query results to any specified file path. While intended for legitimate data export, this could be abused to overwrite critical system files (e.g., `/etc/hosts`, `/etc/resolv.conf`) with database output, potentially leading to denial of service or system disruption. Additionally, if sensitive data is queried, writing it to an insecure or publicly accessible location could lead to unintended data exposure. Although the `SKILL.md` and script include strong safeguards against non-read SQL, the file write capability introduces a significant risk without clear malicious intent.