extract parameters from a given URL and save them into a MySQL database. use when you need to store URL query parameters for later processing or analysis.

This skill contains legitimate functionality but has important problems you should address before installing or running it: - Do not run this against production or sensitive databases yet. The code will create tables and add columns based on URL parameter names. - The script uses environment variables DB_HOST/DB_USER/DB_PASSWORD/DB_NAME but the skill metadata and README do not declare them. Ensure you supply credentials only for a safe, isolated test database. - Major security issue: column names are built directly from URL parameter names and interpolated into CREATE TABLE and INSERT SQL without quoting or validation. An attacker-controlled URL could cause SQL syntax errors or SQL injection via crafted identifier names. Fix by validating/whitelisting parameter names, quoting identifiers safely (e.g., backticks after strict validation), or mapping parameter names to safe column names. - Add explicit dependency documentation: require Python and mysql-connector-python (or equivalent), and include instructions for installing them. - Consider changing design: instead of dynamic columns, store parameters as key/value rows or a JSON column to avoid dynamic identifier creation. If you cannot review and fix the code yourself, treat the skill as unsafe for use with any database that contains sensitive data or production credentials.

Type: OpenClaw Skill Name: cshi Version: 1.0.0 The skill contains critical SQL injection vulnerabilities in scripts/save_url_params.py. The script dynamically constructs SQL 'CREATE TABLE' and 'INSERT' statements using f-strings that incorporate unsanitized keys directly from URL query parameters. An attacker could exploit this by providing a crafted URL to execute arbitrary SQL commands or manipulate the database schema. However, because the code's behavior aligns with its stated purpose and lacks evidence of intentional malice or data exfiltration, it is classified as suspicious rather than malicious.