mssql-cli
Warn
Audited by Gen Agent Trust Hub on Mar 9, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The helper script
scripts/parse_connection_string.pyextracts values from a database connection string to create command-line flags. While it escapes the password, it does not sanitize or quote other fields like 'Server', 'Database', or 'User'. If these fields contain shell metacharacters (such as semicolons, pipes, or backticks), an attacker providing a connection string could execute arbitrary commands when the resulting flags are evaluated by the shell in the agent's workflow. - [CREDENTIALS_UNSAFE]: The skill manages database credentials and demonstrates passing them as command-line arguments to
mssql-cliandsqlcmd. This practice can expose sensitive passwords to other users or system monitoring tools through the process list or shell history.
Audit Metadata