sqlserver-tidb-replay

Replay SQL Server slow query logs on TiDB to verify compatibility, compare performance, and generate syntax conversion reports during migration.

This skill appears to do what it says (parse SQL Server slow logs, convert SQL, replay to TiDB, and generate reports), but review and take these precautions before use: - Run only in a test/replica environment. The replay script will execute SQL statements against the provided TiDB endpoint and can modify data. - Provide TiDB credentials with least privilege (ideally a read/limited account or a copy of production data in a sandbox). Avoid using highly privileged or production admin credentials. - The package metadata lists no required env vars, but the README/scripts expect TIDB_HOST,TIDB_PORT,TIDB_USER,TIDB_PASSWORD,TIDB_DATABASE — ensure you supply them securely (prefer CLI args or a secrets manager over committing env vars into shared shells). - The SKILL.md recommends running a PowerShell collector (collect_xe.ps1) that is not included. Obtain and inspect that collector script from a trusted source before running it on Windows servers. - Install Python dependencies (pymysql, pandas) in an isolated virtualenv and inspect the code yourself. The included scripts are readable; verify any additional third-party code you install. - Backup any target database or use an isolated test cluster. Consider running with a user that has transactional or read-only permissions where possible. If you want higher confidence: ask the publisher for the missing collect_xe.ps1, update the skill metadata to declare required env vars, and provide a requirements.txt or install instruction so dependency installation is explicit.

Type: OpenClaw Skill Name: sqlserver-tidb-replay Version: 1.0.0 The skill bundle provides a functional toolset for migrating SQL Server workloads to TiDB by replaying query logs. While the behavior aligns with the stated purpose, the bundle is classified as suspicious due to significant security vulnerabilities: `replay_tidb.py` executes arbitrary SQL statements from input files without validation, and `analyze_results.py` is vulnerable to Cross-Site Scripting (XSS) by embedding raw SQL and database error messages directly into an HTML report without sanitization. No evidence of intentional malice, such as hardcoded backdoors or data exfiltration, was detected.