db-list

Warn

Audited by Gen Agent Trust Hub on Mar 4, 2026

Risk Level: MEDIUMCREDENTIALS_UNSAFECOMMAND_EXECUTION
Full Analysis
  • [CREDENTIALS_UNSAFE]: The skill manages the .v8-project.json file which is designed to store database credentials, including a 'password' field, in plaintext. This is evidenced by the example JSON structure provided in the documentation.- [CREDENTIALS_UNSAFE]: The 'Подробности по базе' (Database details) operation retrieves and displays all fields of a database entry, including passwords, which could lead to accidental exposure during agent interactions.- [COMMAND_EXECUTION]: The skill generates authentication strings (/N"<user>" /P"<password>") for use in command-line templates by other skills. This practice can leak sensitive credentials into shell history or process monitoring logs.- [DATA_EXFILTRATION]: While no external network calls are present in this specific skill, it uses the 'Read' and 'Write' tools to manipulate files containing sensitive credentials, which serves as a prerequisite for potential exfiltration by other compromised skills.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Mar 4, 2026, 11:19 AM
Security Audit — agent-trust-hub — db-list