MySQL Administration

Manage MySQL databases via mysql CLI or Python mysql-connector, supporting queries, schema changes, backups, performance analysis, and user permissions.

This skill appears to implement MySQL admin tasks, but there are gaps and risky patterns you should consider before installing or running it: - Credentials: The skill expects MYSQL_HOST, MYSQL_USER, MYSQL_PASSWORD, MYSQL_DATABASE, etc., but the registry metadata does not declare these. Treat this as requiring sensitive DB credentials. - Inspect before running: The bundled scripts call mysqldump/mysql and use eval and unquoted variables; this can enable command injection if any argument is attacker-controlled. Review the scripts and avoid passing untrusted input. - Secret exposure: Passwords are passed on the command line (e.g., -p$PASSWORD), which can appear in process lists. Prefer using option files, protected environment variables handled by the platform, or mysql client config files with restricted permissions. - Environment impact: QUICKSTART suggests sudo systemctl start mysql and references a hard-coded test path (/home/clawbot/...), so run tests in an isolated environment (container or VM), not against production systems. - Ask the author or maintainer to: (1) declare required env vars/credentials in the skill metadata, (2) avoid eval and quote arguments properly, (3) avoid printing secrets and using passwords on the command line, and (4) explain the {baseDir} substitution and any test scripts referenced. If you must use it now, run in a sandbox with non-production credentials and back up targets first. If you are not comfortable reviewing shell scripts yourself, do not run this skill with privileged credentials or on production systems.

Type: OpenClaw Skill Name: mysqladm Version: 0.1.0 The skill bundle contains several shell scripts (`mysql_query.sh`, `mysql_backup.sh`, and `mysql_restore.sh`) that use the `eval` command to execute shell strings constructed directly from input arguments. This pattern creates a significant shell injection vulnerability, potentially allowing an attacker (or a manipulated AI agent) to achieve Remote Code Execution (RCE) on the host system. While the bundle's functionality aligns with its stated purpose of MySQL administration, the lack of input sanitization in these core scripts represents a high-risk security flaw.