querydb-skill

数据库查询 Skill。当用户需要连接 MySQL/PostgreSQL 等数据库执行 SQL 查询、获取测试数据、验证接口返回数据时使用此 Skill。

This skill appears to do what it says (query DBs and generate test cases), but it ships with hardcoded, usable credentials and a taxpayer ID inside SKILL.md and examples. Before installing or running it: (1) treat the embedded host/username/password as sensitive — do not assume they are safe or public; (2) verify with your organization whether that DB and credentials are legitimate and allowed to be used; (3) do not run the skill on networks where access to that host would leak data; (4) remove or replace any hardcoded credentials with environment variables or a secrets manager and update metadata to declare required creds; (5) review and sandbox any SQL you or the skill runs (it permits arbitrary queries); (6) if these credentials are real and were exposed unintentionally, rotate them and audit access. If you cannot validate the provenance of the embedded DB details, avoid using the skill or run it in an isolated test environment only.

Type: OpenClaw Skill Name: querydb-skill Version: 1.0.0 The skill bundle contains hardcoded database credentials (host, user, password) for a MySQL instance at 10.115.96.247 within both SKILL.md and scripts/db_query.py. While the code appears to function as a legitimate database query and test case generation tool, the inclusion of plaintext credentials and specific local file paths represents a significant security risk, though no clear evidence of intentional malicious exfiltration or remote control was found.