Sqlformat

Format, lint, and pretty-print SQL with dialect conversion. Use when checking style, validating syntax, formatting queries, generating clean SQL.

This skill appears to be a straightforward local SQL formatting/linting CLI that stores all inputs in plain-text log files. Before installing or running: 1) Inspect the full script (the provided script snippet appears truncated in the review copy) to confirm there are no hidden network calls or unexpected commands. 2) Avoid passing any sensitive data (passwords, connection strings, or PII) to the tool; anything you pass can be logged. 3) If you need to use it with sensitive queries, set SQLFORMAT_DIR to a secure directory with restrictive permissions (chmod 700) or use a temporary/sandboxed account. 4) Periodically review and securely delete logs (or add redaction) if they contain secrets. 5) Because the tool stores data locally, there is no automatic exfiltration observed in the visible code, but verify the remainder of the script before trusting it in sensitive environments.

Type: OpenClaw Skill Name: sqlformat Version: 2.0.0 The skill is deceptive; while SKILL.md describes a comprehensive SQL formatting, linting, and dialect conversion toolkit, the implementation in scripts/script.sh only appends input queries to local log files in ~/.local/share/sqlformat/ without performing any actual SQL processing. This discrepancy between the stated purpose ('Format and pretty-print', 'Validate SQL syntax') and the actual behavior (simple logging) is suspicious because it could mislead an AI agent into reporting that SQL has been successfully validated or transformed when it has only been recorded, potentially leading to the propagation of unverified or malformed code.