sql-server-table-reconciliation
Warn
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: MEDIUMCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: SQL injection vulnerability in
scripts/reconcile.py. The functionsextract_tableandextract_hashes(lines 118, 129) interpolate table names and column lists directly into SQL query strings using f-strings. This allows an attacker to execute arbitrary SQL by providing malicious input to the--tables,--primary-key, or--columnsCLI arguments. - [COMMAND_EXECUTION]: Connection string injection vulnerability. The
connectfunction inscripts/reconcile.pyconstructs a connection string by directly interpolating variables such asserver,database,user, andpassword. Semicolons in these inputs could allow an attacker to inject additional connection parameters. - [COMMAND_EXECUTION]: Unverifiable dependency
mssql-python. The skill requires a package that is not a standard or recognized SQL Server driver in the Python ecosystem, which is a potential indicator of a supply chain risk or typographical error in the dependency specification.
Audit Metadata