NYC

SQLCipher Encrypted Database Expert

Warn

Audited by Socket on Feb 15, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

This skill/instruction set is primarily an educational and implementation guide for SQLCipher-based encrypted databases. It contains appropriate, security-focused guidance (Argon2, zeroing, OS keychain, verification) and safe Rust patterns. Main issues are operational/integration risks rather than malicious intent: unsafe string interpolation in Python PRAGMA statements, inconsistent KDF recommendations, presence of test hardcoded keys, and a notable risk that the Python examples may be run against a non-SQLCipher sqlite3 build leading to a false sense of security. There is no evidence of network exfiltration, obfuscation, or backdoor behavior. Overall malware probability is low, but there are moderate security risks due to potential misuse or deployment mistakes. Recommended fixes: avoid f-string PRAGMA key injection (use a safe API or validate/escape the key), clarify KDF recommendation (prefer Argon2id), remove hardcoded test keys from docs, and prominently warn that the sqlite binary/bindings must be SQLCipher-enabled.

Confidence: 85%Severity: 55%
Audit Metadata
Analyzed At
Feb 15, 2026, 08:28 PM
Package URL
pkg:socket/skills-sh/martinholovsky%2Fclaude-skills-generator%2Fsqlcipher-encrypted-database-expert%2F@991eb525f5a7d1032c5abca7fef2727d3ddd887f